Senior Engineer - Endpoint Security

Grant Thornton Capability Center Poland (GTCC) supports the operations of the Grant Thornton Advisors multinational platform. GTCC helps maintain technology and delivery capabilities across markets and time zones, providing operational support to a multinational platform of more than 25,000 professionals across 20+ firms. Employees work with advanced technologies and collaborate internationally to deliver consistent service across the platform.

• Minimum seven years of information technology experience with at least four years in endpoint security engineering.
• Deep hands-on experience administering major endpoint detection and response platforms such as CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, or equivalents.
• Strong knowledge of Windows, macOS, and Linux internals and attacker techniques mapped to the MITRE ATT&CK framework.
• Proficiency in scripting and automation using PowerShell and/or Python with practical experience integrating security platforms via APIs.
• Preferred industry certifications such as GCFA, GCED, OSCP, CISSP, or vendor certification on deployed endpoint platforms.
• Experience with threat hunting, digital forensics, and managing endpoint telemetry pipelines feeding SIEM or data lakes.
• Fluent written and spoken English and Polish languages.

• Own the architecture, deployment, and lifecycle of endpoint detection and response and anti-malware platforms including agent rollout and coverage reporting.
• Design and tune prevention, detection, and exclusion policies to minimize false positives and improve threat blocking.
• Lead endpoint response efforts for malware outbreaks and intrusions alongside the security operations center.
• Build automation for agent health remediation, policy deployment, and compliance reconciliation.
• Mentor endpoint engineers, review designs and changes, and represent endpoint security in architecture and change forums.
• Operate assigned security platforms as services, including capacity planning, patching, upgrades, and vendor case management.
• Automate repetitive configuration and operational tasks, treating platform configuration as code.
• Support incident response and forensic investigations with expertise, evidence, and containment.
• Maintain runbooks, architecture diagrams, and documentation to satisfy audit requirements.
• Participate in on-call rotation and scheduled change windows, including occasional outside standard hours.