Endpoint Engineer, Subject Matter Expert
— EverOps, San Fransico, CA - Remote
- Embedded as a dedicated endpoint and security SME within a client’s IT Infrastructure Engineering team, serving as the primary escalation point for CrowdStrike Falcon, Kandji MDM, Okta IAM, and Azure/Intune, and owning the technical direction, architecture, and day-to-day operations of the endpoint and security tooling stack across a mixed macOS/Windows fleet.
- Executed infrastructure projects from planning through deployment, including host firewall policies with phased rollout strategies and continuous detection tuning across Mac and Windows host groups.
- Conducted incident response investigations using Falcon LogScale (CQL) and threat hunting via Google SecOps, including lateral movement analysis, IOC/IOA management, sandbox-based threat analysis, and forensic artifact collection on compromised endpoints.
- Implemented and maintained Okta SSO/SAML integrations, SCIM provisioning, authentication policies, FastPass/Okta Verify deployment, and Kandji PassPort with Okta OIDC for Mac Login SSO enrollment. Authored Okta Workflows automations for device lifecycle management across Kandji and Jira.
- Contributed to AI-driven automation initiatives, developing tooling for threat hunting query assistance and operational workflows using Python and Bash.
- Collaborated with Security and Compliance teams to ensure systems met SOC 2 requirements, supporting audit preparation by gathering evidence and validating controls.
- Maintained technical documentation including system configurations, runbooks, risk analysis, communications plans, and rollback procedures for each change.
- Windows fleet compliance, CVE remediation, and application packaging and deployment/
- Designed and deployed a production-grade Claude AI solution, integrating secure APIs, infrastructure automation, and monitoring to support scalable enterprise use cases while meeting security and reliability requirements.
- Led end-to-end deployment of Claude AI across infrastructure, implementing access controls, API orchestration, logging, and performance monitoring to ensure high availability and compliance.