Senior Endpoint Security Engineer

We need to output HTML fragment with sections: About the role? The posting includes description: "Come join our passionate team! Barracuda is a leading cybersecurity..." That's about company. Could be "About the role" or "About the company"? The instruction: use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). We need to include sections only when posting has real, specific content. We have content for responsibilities (What You’ll Be Working On, Automation & Detection Engineering, Client Engagement & Service Delivery). We have qualifications (What You Bring To The Role). We have required technical skills (maybe Skills). We have benefits (What You’ll Get From Us). We have Pay (salary range). We have Location (Remote) but location is not a heading; we can put in a short

. We should not repeat job title. No Job ID heading. We need to preserve all substantive info, remove boilerplate: EEO, equal opportunity, etc. Also remove navigation, cookie, legal, scam-warning, duplicated lines, application instructions. The posting includes "Envision Yourself At Barracuda" etc. We'll keep that as part of About the role? Probably we can have an "About the role" paragraph summarizing the role description: "We are seeking a Senior Endpoint Security & IR Engineer..." etc. We need to use

• for any list of duties/requirements/benefits. So for responsibilities we can list bullet points. For qualifications bullet list. For skills bullet list. For benefits bullet list. We must not create sections with filler like "commensurate with experience". Pay section: we have salary range, so include Pay section with that info. Schedule: not mentioned, so omit. We need to output only HTML fragment, no /, no markdown fences. Let's structure:

  About the role

  ...

  Responsibilities

  • ...
  ...
  We have multiple responsibility categories: "What You’ll Be Working On", "Automation & Detection Engineering", "Client Engagement & Service Delivery". Could combine into one responsibilities list. Let's extract bullet points: From "What You’ll Be Working On": - Lead end-to-end incident response engagements across diverse client environments, from initial triage through remediation and lessons learned - Perform host-based forensics using Binalyze AIR for remote evidence acquisition, triage, and analysis at scale - Design custom detection rules within SentinelOne and fine tune protection policies. - Proven experience in windows, mac and linux environments (maybe this is a qualification) - Investigate alerts and threats detected by SentinelOne, including Deep Visibility hunting, threat timeline reconstruction, and MITRE ATT&CK mapping - Analyze Microsoft 365 security incidents including business email compromise, OAuth abuse, mailbox rule manipulation, and Azure AD/Entra ID attacks - Conduct log analysis and threat hunting in Elastic to identify indicators of compromise, lateral movement, and data exfiltration - Leverage Databricks for large-scale log analytics, anomaly detection, and threat hunting across aggregated client telemetry - Document findings in clear, executive-ready incident reports tailored to both technical and non-technical stakeholders - Participate in a 24/7 on-call rotation From "Automation & Detection Engineering": - Develop and maintain Python scripts for evidence collection, log parsing, IOC enrichment, and automated response actions - Build and optimize automated response workflows in Tines to accelerate containment and MTTR - Create and tune detection rules in Elastic and SentinelOne based on investigative findings and emerging threat intelligence - Integrate tooling across the security stack to streamline IR workflows and reduce manual effort. From "Client Engagement & Service Delivery": - Serve as the primary IR point of contact for client stakeholders during active incidents - Conduct client-facing incident briefings, root cause analysis presentations, and post-incident reviews - Deliver actionable remediation guidance tailored to each client's environment and risk tolerance - Maintain SLA commitments for incident acknowledgment, updates, and resolution - Contribute to client security posture assessments and IR readiness recommendations. Now qualifications: "What You Bring To The Role": - Minimum of bachelor’s degree in computer science and 5+ years of hands-on experience in incident response, digital forensics, or security operations - MSSP, MDR, or consulting experience is strongly preferred. - Demonstrated ability to manage multiple client engagements simultaneously. - Proven track record investigating real-world incidents including ransomware, BEC Attacks, lateral movement, data exfiltration etc. - Experience working in multi-tenant environments with diverse security maturity levels. - GIAC certification required; one or more of the following: GCIH, GCFA, GCFE, GNFA - Equivalent certifications considered: OSCP, eCIR, eCDFP, EnCE, SC-200, AZ-500 Now required technical skills: "Required Technical Skills In Core Platforms": - DFIR - Binalyze AIR - remote acquisition, triage, timeline analysis and artifact collection. - EDR - SentinelOne threat investigations, Deep Visibility, detection engineering, policy configuration - Microsoft 365 / Defender - BEC investigation, UAL analysis, Safe Links/Attachments, Entra ID etc. - Analytics - Databricks - large-scale log analysis, SQL/Python notebooks, threat hunting at scale - Automation - workflow automation, playbook development, API integrations and continuous monitoring. We could put these under a "Skills" section. Now benefits: "What You’ll Get From Us": - A team where you can voice your opinion, make an impact, and where you and your experience are valued. - Internal mobility – there are opportunities for cross training and the ability to attain your next career step within Barracuda. - Equity, in the form of non-qualifying options - High-quality health benefits - Retirement Plan with employer match - Career-growth opportunities - Flexible Time Off and Paid Time Off benefits - Volunteer opportunities Now Pay: "The anticipated salary range for this role is $110,000 to $135,000. Actual compensation offered will be dependent upon the individual's skills, experience, and qualifications as they directly relate to the requirements of the position, the budget for the position, and applicable employment laws. At Barracuda, we believe in fair and equitable compensation practices that reflect both market realities and the unique circumstances of each geographical location. We recognize that cost-of-living disparities, market conditions, and other factors can significantly impact compensation expectations in different regions. The compensation range provided in this job description is for illustrative purposes only and may not reflect the actual compensation offers for the position in your location. Final compensation will be determined based on a variety of factors including the candidates’ qualifications and experience." We need to include Pay section with the salary range. We should not include filler like "commensurate with experience". The text includes explanation; we can keep the substantive info: anticipated salary range $110,000 to $135,000. We could summarize but must preserve all substantive information; we should not invent or summarize away detail. However we can keep the sentence about anticipated salary range and maybe note that actual compensation depends on factors. That's substantive. We'll include that paragraph. Now location: "Location: Remote". We'll put a short

  maybe under a heading? Not needed. We'll just include a

  with location. Now we must not include boilerplate: EEO, equal opportunity, etc. Remove lines like "Barracuda Networks is proud to be an Equal Opportunity Employer..." etc. Also remove "Envision Yourself At Barracuda" maybe part of about role; we can keep that as part of description. We need to ensure we don't repeat job title as heading. No heading for job title. Now produce HTML. Let's craft:

  Location: Remote

  About the role

  Come join our passionate team! Barracuda is a leading cybersecurity company providing complete protection against complex threats. Our platform protects email, data, applications, and networks with innovative solutions, and a managed XDR service, to strengthen cyber resilience. Hundreds of thousands of IT professionals and managed service providers worldwide trust us to protect and support them with solutions that are easy to buy, deploy, and use. We are seeking a Senior Endpoint Security & IR Engineer to join our incident response team. You will lead management of our SentinelOne XDR platform, complex investigations across multiple client environments, drive rapid containment of active threats, and serve as a trusted advisor to clients during their most critical security events. This role combines deep technical expertise with client-facing communication skills in a fast-paced, multi-tenant MSSP environment. You will work closely with our Cyber Concierge, Threat Analysts and Automation teams to continuously improve our response capabilities and protect our clients from sophisticated adversaries.

  Responsibilities

  • Lead end-to-end incident response engagements across diverse client environments, from initial triage through remediation and lessons learned
  • Perform host-based forensics using Binalyze AIR for remote evidence acquisition, triage, and analysis at scale
  • Design custom detection rules within SentinelOne and fine tune protection policies
  • Investigate alerts and threats detected by SentinelOne, including Deep Visibility hunting, threat timeline reconstruction, and MITRE ATT&CK mapping
  • Analyze Microsoft 365 security incidents including business email compromise, OAuth abuse, mailbox rule manipulation, and Azure AD/Entra ID attacks
  • Conduct log analysis and threat hunting in Elastic to identify indicators of compromise, lateral movement, and data exfiltration
  • Leverage Databricks for large-scale log analytics, anomaly detection, and threat hunting across aggregated client telemetry
  • Document findings in clear, executive-ready incident reports tailored to both technical and non-technical stakeholders
  • Participate in a 24/7 on-call rotation
  • Develop and maintain Python scripts for evidence collection, log parsing, IOC enrichment, and automated response actions
  • Build and optimize automated response workflows in Tines to accelerate containment and MTTR
  • Create and tune detection rules in Elastic and SentinelOne based on investigative findings and emerging threat intelligence
  • Integrate tooling across the security stack to streamline IR workflows and reduce manual effort
  • Serve as the primary IR point of contact for client stakeholders during active incidents
  • Conduct client-facing incident briefings, root cause analysis presentations, and post-incident reviews
  • Deliver actionable remediation guidance tailored to each client's environment and risk tolerance
  • Maintain SLA commitments for incident acknowledgment, updates, and resolution
  • Contribute to client security posture assessments and IR readiness recommendations

  Qualifications

  • Minimum of bachelor’s degree in computer science and 5+ years of hands-on experience in incident response, digital forensics, or security operations
  • MSSP, MDR, or consulting experience is strongly preferred
  • Demonstrated ability to manage multiple client engagements simultaneously
  • Proven track record investigating real-world incidents including ransomware, BEC attacks, lateral movement, data exfiltration
  • Experience working in multi-tenant environments with diverse security maturity levels
  • GIAC certification required; one or more of the following: GCIH, GCFA, GCFE, GNFA
  • Equivalent certifications considered: OSCP, eCIR, eCDFP, EnCE, SC-200, AZ-500

  Skills

  • DFIR – Binalyze AIR: remote acquisition, triage, timeline