Information Security Architect – Endpoint Security / EDR-XDR
Cadence · San Jose · $168,000–$312,000 (stated in the posting)
At Cadence, we hire and develop leaders and innovators who want to make an impact on the world of technology.
Position Overview
We are seeking an experienced Information Security Architect – Endpoint Security to define, architect, and evolve the organization’s enterprise endpoint security strategy, with a primary focus on Endpoint Detection and Response (EDR), Extended Detection and Response (XDR), and modern endpoint protection technologies.
The ideal candidate will have deep expertise in enterprise endpoint security architecture and demonstrated experience designing, implementing, and governing EDR/XDR solutions across large and complex environments. This role will be responsible for establishing the architectural vision, security standards, technical roadmaps, and governance model for endpoint security across Windows, Linux, and macOS platforms.
The role will translate business and security requirements into scalable endpoint security architectures and ensure endpoint controls align with the organization's broader cybersecurity strategy, risk appetite, regulatory obligations, and evolving threat landscape.
The candidate should be comfortable operating at both strategic and technical levels, providing architecture guidance while maintaining sufficient hands-on expertise to evaluate solutions, validate designs, troubleshoot complex security issues, and guide engineering teams.
Key Responsibilities
Endpoint Security Architecture & Strategy
Define and own the enterprise endpoint security architecture and technical strategy across Windows, Linux, and macOS environments.
Develop and maintain the strategic roadmap for EDR, XDR, endpoint protection, endpoint detection, threat prevention, and response capabilities.
Establish enterprise endpoint security architecture principles, standards, reference architectures, and technology patterns.
Architect and govern EDR/XDR solutions for large-scale, geographically distributed, and heterogeneous enterprise environments.
Define security architecture requirements for endpoint protection, detection, telemetry, prevention, isolation, remediation, and threat hunting.
Evaluate current-state endpoint security capabilities and develop target-state architectures and transformation roadmaps.
Assess and recommend EDR/XDR technologies based on security effectiveness, scalability, operational impact, integration capabilities, and total cost of ownership.
Define architectural requirements for endpoint security integrations with SIEM, SOAR, IAM, vulnerability management, ITSM, cloud security, network security, and other enterprise security platforms.
Establish architecture patterns for onboarding new business units, platforms, cloud workloads, and acquired environments into the enterprise endpoint security ecosystem.
Ensure endpoint security architecture supports Zero Trust and defense-in-depth security strategies.
Develop technology-agnostic security requirements and evaluation criteria for EDR/XDR platforms.
EDR/XDR Architecture
Serve as the senior technical authority and architecture SME for the enterprise EDR/XDR capability.
Define the architecture, deployment model, organizational structure, policy hierarchy, and security control framework for EDR/XDR platforms.
Establish enterprise standards for EDR/XDR policies, exclusions, application controls, agent configurations, security controls, and endpoint segmentation.
Define architectural approaches for endpoint coverage, agent health, telemetry collection, detection, response, and centralized management.
Develop scalable designs for EDR/XDR across thousands of enterprise endpoints and diverse operating-system environments.
Establish architecture and governance standards for agent lifecycle management, upgrades, configuration changes, and platform enhancements.
Design integration patterns between EDR/XDR platforms and enterprise SIEM, SOAR, SOC, ticketing, vulnerability management, identity, and cloud security platforms.
Evaluate and guide capabilities such as endpoint telemetry, behavioral detection, threat hunting, automated response, remediation, isolation, rollback, and forensic investigation.
Provide architectural guidance for managed detection and response (MDR) capabilities where applicable.
Review and approve significant EDR/XDR configuration, architecture, and policy changes from an architecture and security-risk perspective.
Ensure EDR/XDR solutions are implemented consistently while allowing appropriate flexibility for different business, technology, and risk requirements.
Threat Detection & Security Architecture
Define endpoint detection and response architecture aligned with current threat intelligence and adversary behaviors.
Develop enterprise detection and response strategies mapped to frameworks such as MITRE ATT&CK.
Establish architectural requirements for endpoint telemetry, behavioral detection, process monitoring, command-line visibility, network activity, and endpoint threat intelligence.
Partner with Security Operations and Incident Response teams to improve endpoint detection and response capabilities.
Provide architecture guidance for threat hunting and advanced endpoint investigation.
Analyze emerging attack techniques, malware trends, persistence mechanisms, lateral movement techniques, and endpoint-based attack vectors.
Define security controls to detect and mitigate common endpoint attack techniques.
Define requirements for automated and analyst-driven endpoint containment and remediation.
Participate in complex security investigations and provide architectural guidance during major incidents.
Conduct post-incident architecture reviews and recommend improvements to endpoint security controls.
Endpoint Security Engineering & Standards
Define enterprise endpoint security baselines and technical security standards.
Establish hardened endpoint configuration requirements and security control frameworks.
Develop reference architectures for Windows, Linux, and macOS endpoint security.
Define security requirements for endpoint management technologies including Intune, SCCM/MECM, Jamf, Ansible, and similar platforms.
Partner with endpoint engineering teams to incorporate security controls into endpoint build and deployment processes.
Provide architecture guidance for vulnerability management, endpoint hardening, application control, and attack-surface reduction.
Define security requirements for endpoint provisioning, configuration, lifecycle management, and decommissioning.
Establish technical standards for endpoint security exceptions, exclusions, risk acceptance, and compensating controls.
Ensure endpoint security architecture supports CIS benchmarks, organizational security standards, audit requirements, and regulatory obligations.
Review proposed infrastructure and technology changes for endpoint security implications.
Enterprise Security Architecture & Integration
Partner with enterprise and solution architects to ensure endpoint security is integrated into the broader enterprise security architecture.
Define security architecture requirements for integrations between endpoint, identity, network, cloud, application, and security operations platforms.
Develop security architecture diagrams, data-flow diagrams, reference designs, and technical standards.
Evaluate security implications of new technologies, applications, infrastructure platforms, and cloud services.
Ensure endpoint security telemetry and controls integrate effectively with enterprise security monitoring and analytics platforms.
Define requirements for security automation and orchestration to improve detection, response, and operational efficiency.
Partner with SOC and security engineering teams to identify opportunities for automation and workflow optimization.
Security Governance, Risk & Compliance
Establish endpoint security architecture governance, standards, and control requirements.
Participate in architecture review boards and technology governance processes.
Assess endpoint security risks and recommend appropriate technical controls and mitigating architectures.
Review security exceptions and provide risk-based recommendations.
Support internal and external audits by providing endpoint security architecture, standards, and control documentation.
Ensure endpoint security designs align with applicable regulatory, compliance, and organizational requirements.
Define metrics and key performance indicators for endpoint security architecture, coverage, control effectiveness, and risk reduction.
Develop executive-level reporting on endpoint security posture, architecture maturity, and strategic initiatives.
Enterprise Transformation & Mergers/Acquisitions
Provide security architecture leadership for mergers, acquisitions, divestitures, and major technology transformations.
Define architecture and migration strategies for integrating acquired environments into the enterprise endpoint security ecosystem.
Assess security architectures, endpoint technologies, EDR/XDR platforms, policies, and security controls within acquired environments.
Develop transition roadmaps to standardize endpoint security capabilities across newly integrated organizations.
Identify architectural gaps, security risks, technical debt, and integration challenges.
Lead or provide technical oversight for large-scale endpoint security transformation initiatives.
Technical Leadership & Collaboration
Serve as a senior technical advisor and subject-matter expert for endpoint security and EDR/XDR.
Provide technical leadership and architectural direction to security engineers and infrastructure teams.
Collaborate with SOC, Incident Response, Network Security, Cloud Security, Identity, Infrastructure, IT, and Application teams.
Translate complex security requirements into practical and scalable technical architectures.
Mentor engineers and security professionals on endpoint security architecture, EDR/XDR, threat detection, and incident response.
Lead technical discussions with security technology vendors and service providers.
Conduct architecture reviews, proof-of-concepts, technical evaluations, and design workshops.
Communicate complex technical risks and architecture decisions effectively to both technical and executive audiences.
Required Qualifications
8+ years of experience in Information Security, Cybersecurity Engineering, Security Architecture, Endpoint Security, Security Operations, or a related field.
Demonstrated experience designing and architecting enterprise endpoint security solutions at scale.
Deep hands-on and architectural experience with EDR and/or XDR technologies.
Experience architecting and governing EDR/XDR environments across thousands of endpoints.
Strong understanding of endpoint security architecture across:
Windows
Linux
macOS
Strong understanding of endpoint attack techniques, malware behavior, persistence, privilege escalation, lateral movement, command execution, and common attacker techniques.
Strong experience with EDR/XDR detection, threat hunting, incident response, remediation, and endpoint isolation.
Experience developing enterprise security standards, architecture patterns, technical baselines, and security controls.
Strong understanding of enterprise networking fundamentals including TCP/IP, DNS, HTTP/HTTPS, TLS, proxies, firewalls, and common security protocols.
Experience designing integrations between EDR/XDR platforms and SIEM, SOAR, ITSM, vulnerability management, identity, and other security technologies.
Strong understanding of security architecture principles, defense-in-depth, Zero Trust, least privilege, and risk-based security design.
Experience with scripting and automation using PowerShell, Python, Bash, or similar technologies.
Strong analytical, architecture, documentation, and problem-solving skills.
Excellent communication skills with the ability to influence technical teams and senior stakeholders.
Ability to operate effectively in a large, complex enterprise environment with multiple technology and infrastructure organizations.
Preferred Qualifications
Experience with multiple leading EDR/XDR platforms and technologies.
Experience evaluating, selecting, and migrating between EDR/XDR platforms.
Experience integrating EDR/XDR technologies with SIEM, SOAR, MDR, ITSM, identity, vulnerability management, and cloud security platforms.
Experience with Microsoft security technologies including Microsoft Defender, Entra ID, Intune, Microsoft 365 Defender, and related security services.
Experience with enterprise EDR/XDR platforms such as SentinelOne, CrowdStrike, Microsoft Defender for Endpoint, Palo Alto Cortex XDR, or similar technologies.
Experience architecting security solutions in Azure and/or AWS.
Strong knowledge of the MITRE ATT&CK framework and adversary techniques.
Experience with vulnerability management platforms such as Tenable.
Experience with CIS benchmarks, endpoint hardening, security baselines, and compliance frameworks.
Experience with enterprise endpoint management platforms including SCCM/MECM, Intune, Jamf, Ansible, or similar technologies.
Experience with Zero Trust architecture and endpoint security modernization.
Experience leading endpoint security architecture assessments and technology evaluations.
Experience supporting mergers, acquisitions, divestitures, and enterprise technology integrations.
Security architecture certifications such as CISSP, SABSA, CCSP, or GIAC are preferred.
The annual salary range for California is $168,000 to $312,000. You may also be eligible to receive incentive compensation: bonus, equity, and benefits. Sales positions generally offer a competitive On Target Earnings (OTE) incentive compensation structure. Please note that the salary range is a guideline and compensation may vary based on factors such as qualifications, skill level, competencies and work location. Our benefits programs include: paid vacation and paid holidays, 401(k) plan with employer match, employee stock purchase plan, a variety of medical, dental and vision plan options, and more.