Senior Engineer Endpoint Security
Required Qualifications
- Seven or more years in information technology with at least four years dedicated to endpoint security engineering in an enterprise of comparable scale.
- Deep hands-on experience administering a major endpoint detection and response platform, such as CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, or an equivalent, including policy design and detection tuning.
- Strong working knowledge of Windows, macOS, and Linux internals, together with attacker techniques mapped to the MITRE ATT&CK framework.
- Scripting and automation proficiency in PowerShell, Python, or both, and practical experience integrating security platforms through their APIs.
Preferred Qualifications
- Industry certification such as GCFA, GCED, OSCP, CISSP, or a vendor certification on the deployed endpoint platform.
- Experience with threat hunting, digital forensics, and endpoint telemetry pipelines feeding a SIEM or data lake.
Working Arrangements and Team Expectations
This role sits within the Information Security Platform Engineering function and shares a common operating model with the wider team. Engineers own the security platforms they build end to end: design, deployment, day-to-day operation, tuning, and lifecycle management. Work is delivered against agreed service levels and measured on control coverage, platform availability, and the quality of detection and prevention outcomes. Because the teams are distributed across LATAM, EMEA, and North America, all roles require reliable overlap with United States business hours and fluent written and spoken English.
- Operate assigned security platforms as a service, including capacity planning, patching, upgrades, health monitoring, and vendor case management.
- Automate repetitive configuration and operational tasks, and treat platform configuration as code wherever the tooling supports it.
- Support incident response and forensic investigations with platform expertise, evidence, and rapid containment actions.
- Maintain runbooks, architecture diagrams, and control documentation to a standard that satisfies internal audit and external assessment.
- Participate in an on-call rotation and in scheduled change windows, including occasional work outside standard business hours.
Role Purpose
The Senior Engineer for Endpoint Security is the senior technical owner of the endpoint protection estate — endpoint detection and response, anti-malware, application and device control, and host hardening across workstations and servers. The role sets the technical direction for how endpoint controls are configured, tuned, and measured, and acts as the escalation point for the most complex endpoint issues the operations teams cannot resolve. It carries no direct reports but is expected to lead engineers through design reviews, technical mentoring, and platform standards.
What we offer:
- Hybrid working model (2 days in the office and 3 days working remotely)
- Stable employment with an employment contract, private medical care, and a benefits package including MultiSport and a benefits platform
- Opportunity to work in an international environment and collaborate with experienced Grant Thornton experts and professionals from around the world
- A culture based on teamwork, trust, and knowledge sharing
- A well-structured onboarding program to support a smooth start and successful integration into your new role
- Clear career development paths and access to learning and certification programs
- Access to training platforms and tools that support professional growth
- An inclusive workplace that welcomes people with disabilities
- A modern office in Poznań, located in Malta Office Park
- Fluency in Polish and English
Why join Grant Thornton Capability Center Poland?
At Grant Thornton Capability Center Poland (GTCC), employees contribute to meaningful work that moves businesses forward. From day one, team members help deliver value for clients while helping shape the future of a growing delivery center in Poland.
Through supporting operations of our growing multinational platform, employees have opportunities to tackle complex projects, work with advanced technologies and develop the skills needed for what's next. Team members collaborate across countries, markets and time zones, learning from different perspectives and building experience beyond their roles.
At GTCC Poland, teammates succeed together. Knowledge is shared, diverse perspectives are valued, and employees support one another in doing their best work.
Clear career paths, learning opportunities and international exposure help employees continue building skills, expanding capabilities and growing rewarding careers.
About Global Delivery Centers (enterprise description)
Grant Thornton Capability Center (GTCC) support the operations of the Grant Thornton Advisors multinational platform.
We bring together people, technology and delivery capabilities that help teams work across markets and time zones. By supporting shared standards, technology and delivery expectations GTCC help keep work moving, connect teams across the platform and create consistency across the way work is delivered.
We are part of a multinational platform that brings together more than 25,000 professionals across 20+ firms. As organizations grow, enter new markets and face increasing complexity, our centers help provide the scale, coordination and operational support needed to keep work moving forward.
For our people, that means working with colleagues across markets, contributing to work with international reach and helping teams deliver consistently in an environment built on collaboration, accountability and quality.