Information Security Architect – Endpoint Security / EDR-XDR

At Cadence, we hire and develop leaders and innovators who want to make an impact on the world of technology.

Position Overview

We are seeking an experienced Information Security Architect – Endpoint Security to define, architect, and evolve the organization’s enterprise endpoint security strategy, with a primary focus on Endpoint Detection and Response (EDR), Extended Detection and Response (XDR), and modern endpoint protection technologies.

The ideal candidate will have deep expertise in enterprise endpoint security architecture and demonstrated experience designing, implementing, and governing EDR/XDR solutions across large and complex environments. This role will be responsible for establishing the architectural vision, security standards, technical roadmaps, and governance model for endpoint security across Windows, Linux, and macOS platforms.

The role will translate business and security requirements into scalable endpoint security architectures and ensure endpoint controls align with the organization's broader cybersecurity strategy, risk appetite, regulatory obligations, and evolving threat landscape.

The candidate should be comfortable operating at both strategic and technical levels, providing architecture guidance while maintaining sufficient hands-on expertise to evaluate solutions, validate designs, troubleshoot complex security issues, and guide engineering teams.

Key Responsibilities

Endpoint Security Architecture & Strategy

• Define and own the enterprise endpoint security architecture and technical strategy across Windows, Linux, and macOS environments.

• Develop and maintain the strategic roadmap for EDR, XDR, endpoint protection, endpoint detection, threat prevention, and response capabilities.

• Establish enterprise endpoint security architecture principles, standards, reference architectures, and technology patterns.

• Architect and govern EDR/XDR solutions for large-scale, geographically distributed, and heterogeneous enterprise environments.

• Define security architecture requirements for endpoint protection, detection, telemetry, prevention, isolation, remediation, and threat hunting.

• Evaluate current-state endpoint security capabilities and develop target-state architectures and transformation roadmaps.

• Assess and recommend EDR/XDR technologies based on security effectiveness, scalability, operational impact, integration capabilities, and total cost of ownership.

• Define architectural requirements for endpoint security integrations with SIEM, SOAR, IAM, vulnerability management, ITSM, cloud security, network security, and other enterprise security platforms.

• Establish architecture patterns for onboarding new business units, platforms, cloud workloads, and acquired environments into the enterprise endpoint security ecosystem.

• Ensure endpoint security architecture supports Zero Trust and defense-in-depth security strategies.

• Develop technology-agnostic security requirements and evaluation criteria for EDR/XDR platforms.

EDR/XDR Architecture

• Serve as the senior technical authority and architecture SME for the enterprise EDR/XDR capability.

• Define the architecture, deployment model, organizational structure, policy hierarchy, and security control framework for EDR/XDR platforms.

• Establish enterprise standards for EDR/XDR policies, exclusions, application controls, agent configurations, security controls, and endpoint segmentation.

• Define architectural approaches for endpoint coverage, agent health, telemetry collection, detection, response, and centralized management.

• Develop scalable designs for EDR/XDR across thousands of enterprise endpoints and diverse operating-system environments.

• Establish architecture and governance standards for agent lifecycle management, upgrades, configuration changes, and platform enhancements.

• Design integration patterns between EDR/XDR platforms and enterprise SIEM, SOAR, SOC, ticketing, vulnerability management, identity, and cloud security platforms.

• Evaluate and guide capabilities such as endpoint telemetry, behavioral detection, threat hunting, automated response, remediation, isolation, rollback, and forensic investigation.

• Provide architectural guidance for managed detection and response (MDR) capabilities where applicable.

• Review and approve significant EDR/XDR configuration, architecture, and policy changes from an architecture and security-risk perspective.

• Ensure EDR/XDR solutions are implemented consistently while allowing appropriate flexibility for different business, technology, and risk requirements.

Threat Detection & Security Architecture

• Define endpoint detection and response architecture aligned with current threat intelligence and adversary behaviors.

• Develop enterprise detection and response strategies mapped to frameworks such as MITRE ATT&CK.

• Establish architectural requirements for endpoint telemetry, behavioral detection, process monitoring, command-line visibility, network activity, and endpoint threat intelligence.

• Partner with Security Operations and Incident Response teams to improve endpoint detection and response capabilities.

• Provide architecture guidance for threat hunting and advanced endpoint investigation.

• Analyze emerging attack techniques, malware trends, persistence mechanisms, lateral movement techniques, and endpoint-based attack vectors.

• Define security controls to detect and mitigate common endpoint attack techniques.

• Define requirements for automated and analyst-driven endpoint containment and remediation.

• Participate in complex security investigations and provide architectural guidance during major incidents.

• Conduct post-incident architecture reviews and recommend improvements to endpoint security controls.

Endpoint Security Engineering & Standards

• Define enterprise endpoint security baselines and technical security standards.

• Establish hardened endpoint configuration requirements and security control frameworks.

• Develop reference architectures for Windows, Linux, and macOS endpoint security.

• Define security requirements for endpoint management technologies including Intune, SCCM/MECM, Jamf, Ansible, and similar platforms.

• Partner with endpoint engineering teams to incorporate security controls into endpoint build and deployment processes.

• Provide architecture guidance for vulnerability management, endpoint hardening, application control, and attack-surface reduction.

• Define security requirements for endpoint provisioning, configuration, lifecycle management, and decommissioning.

• Establish technical standards for endpoint security exceptions, exclusions, risk acceptance, and compensating controls.

• Ensure endpoint security architecture supports CIS benchmarks, organizational security standards, audit requirements, and regulatory obligations.

• Review proposed infrastructure and technology changes for endpoint security implications.

Enterprise Security Architecture & Integration

• Partner with enterprise and solution architects to ensure endpoint security is integrated into the broader enterprise security architecture.

• Define security architecture requirements for integrations between endpoint, identity, network, cloud, application, and security operations platforms.

• Develop security architecture diagrams, data-flow diagrams, reference designs, and technical standards.

• Evaluate security implications of new technologies, applications, infrastructure platforms, and cloud services.

• Ensure endpoint security telemetry and controls integrate effectively with enterprise security monitoring and analytics platforms.

• Define requirements for security automation and orchestration to improve detection, response, and operational efficiency.

• Partner with SOC and security engineering teams to identify opportunities for automation and workflow optimization.

Security Governance, Risk & Compliance

…