{"id":4032086,"url":"https://alion.io/job/hub-international-endpoint-security-engineer","title":"Endpoint Security Engineer","company":{"id":1768415,"name":"HUB International","domain":"hubinternational.com","url":"https://alion.io/company/hubinternational-com","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":84,"open_postings":76,"ghost_share":0,"stale_share":0.645,"repost_share":0.013,"time_to_fill_p50_days":43,"computed_at":"2026-11-10T06:52:35Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Chicago, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":130000,"max":140000,"currency":"USD","period":"year","gross":null,"usd_annual":140000},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"DNS","optional":false},{"name":"GCP","optional":false},{"name":"ISO 27001","optional":false},{"name":"Linux","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"NIST 800-53","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"SIEM","optional":false},{"name":"SOC 2","optional":false},{"name":"TCP/IP","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-11-10T18:56:52Z","employer_posted_date":"2026-11-10","last_verified_at":"2026-11-10T18:56:52Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"A path for every ambition.\nAt HUB, we believe the best work happens when people are given real space to grow and then given the autonomy to exercise it. We power progress and protect ambition: for the clients who count on us, and equally for the people who make that possible every day.\nWe’re creative thinkers and determined doers, guided by values that show up in how we work together: with empathy, adaptability, accountability and a genuine commitment to one another’s success. We foster bold ideas, celebrate curiosity and share what we know. Because when people grow, the work they do grows with them.\nOur purpose is deeply human: to help people navigate the world on their terms, at their speed, toward their future. We hold that same commitment to the people building careers here.\nWhether you’re starting out or leveling up, you’ll find the resources to evolve, the support to take on more and a team ready to back you at every stage.\nYour ambition has a home here.\nA path for every ambition.\nAt HUB, we believe the best work happens when people are given real space to grow and then given the autonomy to exercise it. We power progress and protect ambition: for the clients who count on us, and equally for the people who make that possible every day.\nWe’re creative thinkers and determined doers, guided by values that show up in how we work together: with empathy, adaptability, accountability and a genuine commitment to one another’s success. We foster bold ideas, celebrate curiosity and share what we know. Because when people grow, the work they do grows with them.\nOur purpose is deeply human: to help people navigate the world on their terms, at their speed, toward their future. We hold that same commitment to the people building careers here.\nWhether you’re starting out or leveling up, you’ll find the resources to evolve, the support to take on more and a team ready to back you at every stage.\nYour ambition has a home here.\nJob Description\nIn this role, you will own the engineering and day-to-day management of HUB’s enterprise endpoint detection and response (EDR) platform, including policy design, exclusion governance, agent lifecycle, and detection tuning. You will also assess the EDR solutions inherited through mergers and acquisitions (M&A), measuring configuration and policy parity against HUB’s standard EDR baseline to guide integration, migration, or coexistence decisions. This position is part of the Security Operations and Engineering team and works in close collaboration with Security Operations, Incident Response, Governance & Compliance, M&A integration teams, and HUB IT teams to deliver effective, measurable endpoint protection for Hub International.\nObjectives of this Role\nServe as the technical owner of HUB’s enterprise EDR platform, ensuring it is deployed, healthy, and operating at required levels of coverage, service, and availability across all supported endpoints and servers.\nDesign, document, and maintain EDR policies, policy tiers, and group or site structures aligned to HUB security standards and operating system and workload types.\nManage the exclusion lifecycle, including intake, risk review, approval, implementation, periodic recertification, and retirement, so exclusions are justified, scoped as narrowly as possible, and auditable.\nAssess the EDR solutions of acquired and to-be-acquired organizations by building and executing a repeatable, platform-neutral parity-assessment methodology covering configuration, policy settings, exclusion handling, detection and prevention coverage, and operational fit against the HUB EDR baseline.\nProduce parity matrices and gap analyses that map HUB’s baseline EDR configuration and policies to the equivalent controls in each acquired entity’s EDR platform, clearly documenting where parity is full, partial, or not achievable and what remediation or compensating controls are needed.\nContribute to continuous improvement of response playbooks, detection content, and endpoint security tooling and posture.\nContribute to operations KPIs that measure endpoint coverage, agent health, detection quality, and exclusion hygiene.\nMaintain current knowledge of endpoint threats, EDR/XDR technology, and adversary techniques, bringing forward ideas for modernization and improvement.\nBe available for critical security incident response that requires immediate endpoint containment, investigation, or remediation.\nEngage with peers regularly on endpoint security operations, project status, activities, and achievements.\nContribute to security requirements, standards, procedures, and reference architectures for endpoint protection in compliance with HUB policies and technical standards.\nDaily and Monthly Responsibilities\nMonitor EDR console health, agent coverage, agent version compliance, and policy drift; remediate unhealthy, outdated, or unmanaged endpoints in partnership with IT.\nReview and triage endpoint alerts and threat detections, tune detections to reduce false positives, and escalate confirmed incidents to Security Operations and Incident Response.\nProcess exclusion requests: validate business justification, assess risk, scope by path, hash, certificate, or process as appropriate, implement approved exclusions, and maintain a central exclusion register with owners and review dates.\nPerform scheduled recertification of existing exclusions and remove those that are stale, overly broad, or no longer required.\nPlan, test, and stage agent upgrades, policy changes, and console configuration changes using pilot rings and documented change-management practices.\nMaintain endpoint automation, integrations, and reporting using platform APIs, SIEM integrations, SOAR playbooks, and scripting.\nConduct EDR assessments for M&A targets and newly acquired entities: review tenant configuration, policies, exclusions, agent coverage, and detection settings, and compare them against the HUB EDR baseline to identify gaps and risk.\nMaintain configuration and policy parity documentation for each acquired entity, including side-by-side mappings to the HUB baseline, identified gaps, compensating controls, and recommended paths (remediate in place, migrate to the HUB platform, or coexist).\nContribute to root-cause analysis for security incidents and events, and establish preventive measures, mitigations, or remediations.\nContribute to weekly and monthly posture and response operations reporting, including endpoint coverage, exclusion metrics, and platform evaluation status.\nAssist in configuring new applications and infrastructure for needed endpoint and security telemetry.\nContribute to analysis and recommendations for upgrades, changes, and implementations that support the scaling of HUB’s security operations.\nSupport M&A due diligence and post-close integration planning by providing endpoint security findings, migration effort estimates, and risk summaries to Security leadership and integration teams.\nManage platform support cases and escalations, and track product roadmap items relevant to HUB.\nSupport the HUB Information Security Governance & Compliance team as needed during risk assessments, internal and external information security audits, and third-party reviews.\nSkills and Qualifications\nBachelor’s degree in technology or applicable experience.\nRelated certifications (e.g., EDR platform administrator certifications, GSEC, GCIH, GCFE/GCFA, CISSP, AWS) preferred.\n5+ years of experience in information security operations or engineering, including 3+ years administering and engineering enterprise EDR platforms; hands-on experience with a leading enterprise EDR platform required.\nDemonstrated experience designing endpoint security policies and managing exclusions at enterprise scale, including balancing protection, application compatibility, and performance.\nExperience assessing, integrating, or migrating between EDR/XDR products commonly found in acquired environments, including mapping configuration and policy equivalency between platforms; M&A security integration experience preferred.\nStrong knowledge of Windows, macOS, and Linux internals relevant to endpoint security, including process behavior, file system and registry activity, and common attack techniques mapped to MITRE ATT&CK.\nExperience with endpoint deployment and management tooling (e.g., MDM, software distribution, and configuration management platforms), and with Active Directory / MS Entra ID.\n3+ years of experience with security incident response and operations, including endpoint investigation, containment, and remediation.\n3+ years of experience with cloud infrastructure (AWS, GCP, Azure) and O365 services and technology.\n2+ years of experience defining, refining, and driving efficiency in operational processes.\nExperience with SIEM and SOAR technologies, and with KQL, SPL, or other query languages, including EDR threat-hunting query languages.\nExperience with PowerShell, Python, and shell scripting, and with REST APIs for automation and reporting.\nWorking knowledge of TCP/IP, DNS, and network and Windows Event logging.\nKnowledge of information security standards, principles, and practices, and of regulatory and compliance requirements such as ISO 27001, NIST 800-53, SOC 2, PCI, and SOX, particularly as they apply to endpoint controls and exception management.\nKnowledge of email transmission, routing, and authentication concepts, including SMTP, SPF, DKIM, and DMARC.\nStrong prioritization, decision-making, critical thinking, documentation, communication, and relationship-building skills.\nAbility to work independently and in a team environment.\nPay transparency\nThe expected salary range for this position is $130,000- $140,000 and will be impacted by factors such as the successful candidate’s skills, experience and working location, as well as the specific position’s business line, scope and level. HUB International is proud to offer comprehensive benefit and total compensation packages: health/dental/vision/life/disability insurance, FSA, HSA and 401(k) accounts, paid-time-off benefits such as vacation, sick, and personal days, and eligible bonuses, equity and commissions for some positions.\nThe HUB difference\nHUB International is one of North America’s largest insurance brokers, delivering risk management, insurance, employee benefits, retirement and wealth management solutions to businesses and individuals across the United States and Canada - through locally led teams backed by national expertise, giving you the agility of a local partner and the reach of a global organization.\nWhat we offer you\nWe invest in your growth. HUB offers structured training, licensing support,and ongoing development opportunities designed to accelerate your career. Benefits and programs vary based on employment status, role, location, and applicable eligibility requirements.\nCompetitive pay with comprehensive health benefits, retirement savings matching, and company-paid life and disability plans\nGenerous paid time off, paid parental leave and a wellbeing program designed to support real work/life balance\nA collaborative, high-performing culture with meaningful engagement, community impact through HUB Gives and genuine room to grow your career\nThe HUB difference\nHUB International is one of North America’s largest insurance brokers, delivering risk management, insurance, employee benefits, retirement and wealth management solutions to businesses and individuals across the United States and Canada - through locally led teams backed by national expertise, giving you the agility of a local partner and the reach of a global organization.\nEqual Employment Opportunity: HUB International Limited is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, protected veteran status, or any other characteristic protected by applicable federal, state, or local la...","description_format":"text","description_chars":12709,"description_truncated":true,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity","Parental leave"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Endpoint Security","Vulnerability Management","Health Insurance & Benefits","Insurance Brokers & Agencies"],"lifecycle":[{"event":"open","at":"2026-11-10T18:56:52Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":43,"reasons":["conf:0","win:early","comp:brand"],"computed_at":"2026-11-10T19:56:05Z"},"pay":{"stated_usd_annual":140000,"is_top_pay":false},"html_url":"https://alion.io/job/hub-international-endpoint-security-engineer","json_url":"https://alion.io/job/hub-international-endpoint-security-engineer.json","meta":{"generated_at":"2026-11-10T19:56:05Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":11769,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-11T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1768415},"rest":"https://alion.io/mcp/rest/get_company?id=1768415"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fhub-international-endpoint-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fhub-international-endpoint-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fhub-international-endpoint-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/hub-international-endpoint-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fhub-international-endpoint-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4032086}},{"tool":"search_jobs","arguments":{"company":"hubinternational.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4032086},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}