Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 19 hours ago

Security Engineer

Legato Security1 open role

Where
Remote Office; Salt Lake City, Utah, United States
Work mode
Remote
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSecurity EngineerLegato Security · Remote Office; Salt Lake City, Utah, United States

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Legato Security's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.3% of postings close within 7 days. Measured by our own scanner across the market. Legato Security postings stay open a median of 34 days.

Share of postings closed within
  1. 2.1%1 day
  2. 4.5%3 days
  3. 12.3%7 days
  4. 19.7%14 days
  5. 35.6%30 days
  6. 58.0%60 days
This job: posted 19 hours ago

Legato Security median: 34 days open

The posting

Who We Are

Legato Security is an information security firm founded upon the belief that every organization has the right to keep its data private and secure. Our mission is to build close partnerships with our clients, serving them not as just a vendor, but as trusted advisors helping to build effective, proactive plans. Our focus is always on both the technical and human elements within an organization. We believe in comprehensive strategies designed to harden networks, deflect attackers, and rapidly recover from any accidents. As technology progresses, so do our tactics, ensuring our experts are always prepared to serve forward-looking leaders eager to stay ahead of emerging threats.

Position Overview

Legato Security is hiring a Security Engineer to own endpoint detection and response across our managed security customers. You'll be our subject matter expert to help deploy, tune, and run CrowdStrike Falcon, Microsoft Defender for Endpoint, Carbon Black, and SentinelOne in customer environments, as well as managing the SIEM pipelines that keep telemetry healthy.

You’ll work with in-house teams (including other Security Engineers on our team, and SOC Analysts) to identify the right mix of tools, techniques, and procedures to translate our customer’s needs and future goals into a plan that will enable secure and effective solutions. In determining the best solutions, you will investigate new techniques, break free from the legacy model, and help customers exceed industry standards. As a team, we’ll take a critical approach to solution design, identifying gaps, providing alternatives, and customizing solutions to maintain a balance of security and business needs. This position is open to remote personnel anywhere within the U.S.

Specific Job Responsibilities

  • Administer multi-tenant consoles (Falcon Flight Control parent/child CIDs, Defender multi-tenant management, SentinelOne sites and groups), including RBAC, policy inheritance, and sensor update rings
  • Tune prevention and detection policies to cut noise without opening gaps
  • Track sensor health and coverage: Unmanaged hosts, reduced-functionality mode, stale sensors, and version drift
  • Administer EDR-to-SIEM pipelines into Sumo Logic Cloud SIEM, Microsoft Sentinel, and Stellar Cyber
  • Build and maintain API integrations between EDR platforms, SOAR, ticketing, and threat intel
  • Plan and run EDR deployments and migrations for new customers: Sensor rollout through Intune, SCCM, GPO, or Jamf; policy design; exclusions

Required Qualifications

  • 2+ years deploying or administering an enterprise EDR (CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, or comparable) in production, plus 2+ years of systems administration
  • At least one EDR deployment or migration you ran end to end: Rollout, policy, exclusions, and handoff to operations
  • Experience with Windows internals and macOS/Linux administration to troubleshoot sensor problems, such as service failures, system extensions, eBPF, AV conflicts, proxies, and TLS inspection
  • Active experience with SIEM work, e.g. onboarding of log sources, event parsing, field extractions, and query creation across a variety of tools
  • PowerShell plus Python or Go, including scripting API access and endpoint deployment scripts
  • Working knowledge of MITRE ATT&CK and how attacker techniques show up in endpoint telemetry
  • Excellent writing skills for creating runbooks, incident summaries, and configuration guides

Preferred Qualifications

  • 4+ years focused on CrowdStrike Falcon or SentinelOne, or production experience with more than one of the following EDR products: Falcon, Defender for Endpoint, and SentinelOne
  • MSSP or other multi-tenant operations experience
  • Sysmon deployment and configuration tuning, for customers without a commercial EDR or as extra visibility alongside one
  • Experience supporting federal or public-sector environments: NIST SP 800-53 controls, the Risk Management Framework, FedRAMP, and federal security authorization and assessment processes

Perks

  • Start-up company in a growth phase with opportunity for advancement based on performance
  • Start-up culture with an office in downtown Salt Lake City, UT
  • Competitive medical and dental benefits for employee and family members
  • Other company-provided benefits such as short-term disability, basic life insurance, children’s orthodontia, with additional voluntary benefits available, and 401K match
  • Flexible Paid Time Off policy
  • Professional Development opportunities specific to role

Embark on a journey where your skills are valued, your growth is fostered, and your voice is heard. At Legato Security, we understand that diversity is the key to innovation. Our hiring process is designed to provide a transparent, consistent, and uniform experience for all applicants, mitigating unconscious bias every step of the way. We foster a culture of belonging, where each team member is an integral part of the Legato community.

Legato Security is an equal-opportunity employer

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Legato Security's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Legato Security's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Legato Security's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.