Senior Endpoint Security Specialist - Global Security Organization

TikTok's Global Security Organization (GSO) builds and earns trust by reducing risk and securing our businesses and products. GSO is the foundation of our efforts to keep TikTok safe, secure, and operating at scale for over 1 billion people worldwide. The team ensures the TikTok platform remains safe and secure, protects user data from external or internal threats, and ensures compliance with global regulations. Security is integral to TikTok’s success, safeguarding user interactions—whether watching videos, engaging with Live content, or shopping on TikTok Shop.

About the role

The SecOps Validation Team (STOV) oversees the tools and technologies supporting TikTok’s infrastructure. This role defines enterprise security technical controls and implements validation mechanisms within TikTok environments to ensure effectiveness and compliance. It includes offensive security activities to assess the strength of existing response measures and collaborates with cross-functional teams to establish measurable, repeatable processes that continuously enhance the organization’s security posture.

Responsibilities

• Build automated, repeatable validation workflows using infrastructure-as-code and automation frameworks to continuously validate technical control efficacy across servers (Linux/Windows), endpoints (macOS/Windows), email systems, IoT devices, and physical infrastructure.
• Conduct STRIDE-based threat modeling on new services/infrastructure, building secure design libraries (cryptography, input validation) to enforce patterns and prevent vulnerabilities. Plan and execute assessments to test host-based detection/prevention controls under realistic attack scenarios, including EDR evasion, defense-bypass methods, and post-exploitation tradecraft.
• Design and implement fault-tolerant, real-time data ingestion pipelines (Apache Flink/Spark Streaming, Kafka) and columnar data lakes (ClickHouse) to process petabytes of global endpoint security telemetry (HIDS, EDR, NDR, audit logs, IDS/IPS).
• Build technical roadmaps and lead full-stack development of internal endpoint security tools, including technical validation platforms, scanners, secrets management integrations, and IAM policy engines—from gRPC/Protobuf API design to Kubernetes deployment with Istio service mesh.
• Develop and harden core detection engineering platforms, enabling Sigma/YARA-L rule codification, automated backtesting against historical data, and CI/CD deployment to SIEM (Splunk ES, Chronicle) and EDR endpoints.
• Research emerging MITRE ATT&CK TTPs, prototype behavioral analytics and ML-driven anomaly detection models to identify stealthy adversaries evading traditional signature-based defenses, and establish measurable technical security controls aligned to NIST, CIS, and MITRE ATT&CK frameworks for enterprise environments spanning servers, endpoints, email, IoT, and physical infrastructure.
• Build low-code/no-code validation playbooks and microservices to automate technical validation workflows, integrating with CMDBs, ITSM tools, and infrastructure APIs for issue remediation.

Qualifications

Minimum Qualifications:

• Platform & Infrastructure Expertise: Deep hands-on experience with server (Linux, Windows), Kubernetes, and enterprise endpoint (macOS, Windows) technologies, with a track record of balancing security posture against operational and user-experience requirements.
• Adversary Simulation Experience: Proven experience simulating advanced threat actor behavior in live, production-scale environments using Breach-and-Attack Simulation (BAS) frameworks and tooling.
• Threat Intelligence: Deep working knowledge of attacker Tactics, Techniques, and Procedures (TTPs) mapped to the MITRE ATT&CK framework, with experience translating threat intelligence into actionable detection rules.
• Engineering & Development: Proficiency in at least one programming or scripting language (Python, Go, Bash, or C/C++) with strong debugging and automation skills.
• Offensive Security: Strong understanding of EDR evasion techniques, defense-bypass methods, and post-exploitation tradecraft.

Preferred Qualifications:

• Hands-on experience building security automation pipelines using infrastructure-as-code and CI/CD tooling (e.g., Ansible, Terraform, Jenkins, Chef, Puppet) and test-automation frameworks.
• Familiarity with policy-as-code platforms (e.g., Open Policy Agent) or continuous security control validation solutions (e.g., AttackIQ, SafeBreach, Cymulate).
• Experience with purple team operations, including collaborative detection validation with blue teams, tuning detection logic, and measuring coverage against ATT&CK Navigator heatmaps.
• Working knowledge spanning multiple security domains beyond host/endpoint—including application security (SAST/DAST), cloud security (CSPM, CWPP), network security, and data protection.
• Background in product development or engineering of enterprise security tooling (e.g., DLP engines, EDR agents, centralized logging/SIEM platforms).
• Experience operating in large-scale, globally distributed enterprises or high-velocity engineering-driven organizations.
• Master's degree in Computer Science, Information Security, or a related technical discipline; or relevant certifications such as OSCP, CRTO, GPEN, CISSP, or CCSP.

Benefits

• Day-one access to medical, dental, and vision insurance.
• 401(k) savings plan with company match.
• Paid parental leave, short-term and long-term disability coverage, and life insurance.
• Wellbeing benefits.
• 10 paid holidays per year.
• 10 paid sick days per year.
• 17 days of Paid Personal Time (prorated upon hire with increasing accruals by tenure).

Pay

The base salary range for this position in the selected city is $111,600 - $162,000 annually. Compensation may vary outside of this range depending on qualifications, skills, competencies, experience, and location. Base pay is one part of the total package, which may also include discretionary bonuses/incentives and restricted stock units.

Schedule

• Full-time position.