Senior Endpoint Security Engineer

Barracuda is seeking a Senior Endpoint Security & IR Engineer to lead incident response engagements, manage its SentinelOne XDR platform, investigate threats across client environments, and coordinate rapid containment. The role also develops detection and automation capabilities, delivers client-facing incident guidance, and improves response readiness in a multi-tenant MSSP environment.

Responsibilities:

• Lead end-to-end incident response engagements across diverse client environments, from initial triage through remediation and lessons learned
• Perform host-based forensics using Binalyze AIR for remote evidence acquisition, triage, and analysis at scale
• Design custom detection rules within SentinelOne and fine tune protection policies
• Investigate alerts and threats detected by SentinelOne, including Deep Visibility hunting, threat timeline reconstruction, and MITRE ATT&CK mapping
• Analyze Microsoft 365 security incidents including business email compromise, OAuth abuse, mailbox rule manipulation, and Azure AD/Entra ID attacks
• Conduct log analysis and threat hunting in Elastic to identify indicators of compromise, lateral movement, and data exfiltration
• Leverage Databricks for large-scale log analytics, anomaly detection, and threat hunting across aggregated client telemetry
• Document findings in clear, executive-ready incident reports tailored to both technical and non-technical stakeholders
• Participate in a 24/7 on-call rotation
• Develop and maintain Python scripts for evidence collection, log parsing, IOC enrichment, and automated response actions
• Build and optimize automated response workflows in Tines to accelerate containment and MTTR
• Create and tune detection rules in Elastic and SentinelOne based on investigative findings and emerging threat intelligence
• Integrate tooling across the security stack to streamline IR workflows and reduce manual effort
• Serve as the primary IR point of contact for client stakeholders during active incidents
• Conduct client-facing incident briefings, root cause analysis presentations, and post-incident reviews
• Deliver actionable remediation guidance tailored to each client's environment and risk tolerance
• Maintain SLA commitments for incident acknowledgment, updates, and resolution
• Contribute to client security posture assessments and IR readiness recommendations

Requirements:

• Expert knowledge and experience in SentinelOne – Key Requirement
• Proven experience in windows, mac and linux environments
• Minimum of bachelor's degree in computer science and 5+ years of hands-on experience in incident response, digital forensics, or security operations
• Demonstrated ability to manage multiple client engagements simultaneously
• Proven track record investigating real-world incidents including ransomware, BEC Attacks, lateral movement, data exfiltration etc
• Experience working in multi-tenant environments with diverse security maturity levels
• GIAC certification required; one or more of the following:

• GCIH (GIAC Certified Incident Handler)
• GCFA (GIAC Certified Forensic Analyst)
• GCFE (GIAC Certified Forensic Examiner)
• GNFA (GIAC Network Forensic Analyst)
• Equivalent certifications considered: OSCP, eCIR, eCDFP, EnCE, SC-200, AZ-500

• DFIR - Binalyze AIR - remote acquisition, triage, timeline analysis and artifact collection
• EDR - SentinelOne threat investigations, Deep Visibility, detection engineering, policy configuration
• Microsoft 365 / Defender - BEC investigation, UAL analysis, Safe Links/Attachments, Entra ID etc
• Analytics - Databricks - large-scale log analysis, SQL/Python notebooks, threat hunting at scale
• Automation - workflow automation, playbook development, API integrations and continuous monitoring
• MSSP, MDR, or consulting experience is strongly preferred
• Experience with additional EDR platforms (CrowdStrike, Microsoft Defender for Endpoint)
• Advanced knowledge of macOS and Linux forensics
• Familiarity with threat intelligence platforms (MISP, Recorded Future, Virus Total Enterprise)
• Experience with Velociraptor, KAPE, or Volatility for advanced forensic collection and investigations
• Prior experience in IR teams or serving as an IR practice SME