{"id":3293939,"url":"https://alion.io/job/legato-security-security-engineer","title":"Security Engineer","company":{"id":2462429,"name":"Legato Security","domain":"legatosecurity.com","url":"https://alion.io/company/legatosecurity","size_band":"11-50","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":null},"role":"Security","role_family":"Security","seniority":"junior","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Salt Lake City, United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":72000,"max_usd":151000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":66},"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Carbon Black","optional":false},{"name":"Crowdstrike","optional":false},{"name":"eBPF","optional":false},{"name":"Linux","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SentinelOne","optional":false},{"name":"SIEM","optional":false},{"name":"Sumo Logic","optional":false},{"name":"Windows","optional":false},{"name":"FedRAMP","optional":true},{"name":"Sysmon","optional":true}],"status":"live","first_seen_at":"2026-10-26T19:12:45Z","employer_posted_date":"2026-10-26","last_verified_at":"2026-10-27T22:26:44Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Who We Are \n\nLegato Security is an information security firm founded upon the belief that every organization has the right to keep its data private and secure. Our mission is to build close partnerships with our clients, serving them not as just a vendor, but as trusted advisors helping to build effective, proactive plans. Our focus is always on both the technical and human elements within an organization. We believe in comprehensive strategies designed to harden networks, deflect attackers, and rapidly recover from any accidents. As technology progresses, so do our tactics, ensuring our experts are always prepared to serve forward-looking leaders eager to stay ahead of emerging threats.\n\nPosition Overview \n\nLegato Security is hiring a Security Engineer to own endpoint detection and response across our managed security customers. You'll be our subject matter expert to help deploy, tune, and run CrowdStrike Falcon, Microsoft Defender for Endpoint, Carbon Black, and SentinelOne in customer environments, as well as managing the SIEM pipelines that keep telemetry healthy.\nYou’ll work with in-house teams (including other Security Engineers on our team, and SOC Analysts) to identify the right mix of tools, techniques, and procedures to translate our customer’s needs and future goals into a plan that will enable secure and effective solutions. In determining the best solutions, you will investigate new techniques, break free from the legacy model, and help customers exceed industry standards. As a team, we’ll take a critical approach to solution design, identifying gaps, providing alternatives, and customizing solutions to maintain a balance of security and business needs. This position is open to remote personnel anywhere within the U.S.\n\nSpecific Job Responsibilities \n\nAdminister multi-tenant consoles (Falcon Flight Control parent/child CIDs, Defender multi-tenant management, SentinelOne sites and groups), including RBAC, policy inheritance, and sensor update rings\nTune prevention and detection policies to cut noise without opening gaps\nTrack sensor health and coverage: Unmanaged hosts, reduced-functionality mode, stale sensors, and version drift\nAdminister EDR-to-SIEM pipelines into Sumo Logic Cloud SIEM, Microsoft Sentinel, and Stellar Cyber\nBuild and maintain API integrations between EDR platforms, SOAR, ticketing, and threat intel\nPlan and run EDR deployments and migrations for new customers: Sensor rollout through Intune, SCCM, GPO, or Jamf; policy design; exclusions \n\n Required Qualifications \n\n2+ years deploying or administering an enterprise EDR (CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, or comparable) in production, plus 2+ years of systems administration\nAt least one EDR deployment or migration you ran end to end: Rollout, policy, exclusions, and handoff to operations\nExperience with Windows internals and macOS/Linux administration to troubleshoot sensor problems, such as service failures, system extensions, eBPF, AV conflicts, proxies, and TLS inspection\nActive experience with SIEM work, e.g. onboarding of log sources, event parsing, field extractions, and query creation across a variety of tools\nPowerShell plus Python or Go, including scripting API access and endpoint deployment scripts\nWorking knowledge of MITRE ATT&CK and how attacker techniques show up in endpoint telemetry\nExcellent writing skills for creating runbooks, incident summaries, and configuration guides\nPreferred Qualifications \n4+ years focused on CrowdStrike Falcon or SentinelOne, or production experience with more than one of the following EDR products: Falcon, Defender for Endpoint, and SentinelOne\nMSSP or other multi-tenant operations experience\nSysmon deployment and configuration tuning, for customers without a commercial EDR or as extra visibility alongside one\nExperience supporting federal or public-sector environments: NIST SP 800-53 controls, the Risk Management Framework, FedRAMP, and federal security authorization and assessment processes\n\nPerks \n\nStart-up company in a growth phase with opportunity for advancement based on performance \nStart-up culture with an office in downtown Salt Lake City, UT \nCompetitive medical and dental benefits for employee and family members \nOther company-provided benefits such as short-term disability, basic life insurance, children’s orthodontia, with additional voluntary benefits available, and 401K match \nFlexible Paid Time Off policy \nProfessional Development opportunities specific to role \n\nEmbark on a journey where your skills are valued, your growth is fostered, and your voice is heard. At Legato Security, we understand that diversity is the key to innovation. Our hiring process is designed to provide a transparent, consistent, and uniform experience for all applicants, mitigating unconscious bias every step of the way. We foster a culture of belonging, where each team member is an integral part of the Legato community. \nLegato Security is an equal-opportunity employer","description_format":"text","description_chars":5005,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["401k plan","Life insurance","Professional development"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","Managed Security"],"lifecycle":[{"event":"open","at":"2026-10-26T21:05:22Z"}],"visa":[],"liveness":{"score":95,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.946,"p_room":1,"age_days":0,"expected_fill_days":7,"reasons":["conf:1","urgency","win:early","comp:junior"],"computed_at":"2026-10-27T05:46:45Z"},"pay":null,"html_url":"https://alion.io/job/legato-security-security-engineer","json_url":"https://alion.io/job/legato-security-security-engineer.json","meta":{"generated_at":"2026-10-28T01:07:53Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1388,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-29T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2462429},"rest":"https://alion.io/mcp/rest/get_company?id=2462429"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Flegato-security-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Flegato-security-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Flegato-security-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/legato-security-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Flegato-security-security-engineer"}]}