Information Security Engineer - Endpoint
Secures Palantir's global Windows and Active Directory infrastructure by hardening configurations, reducing attack surfaces, deploying defensive tools like EDR and PAM, and building detection automation. Requires 5+ years hands-on experience with AD attacks, Windows internals, and Python/PowerShell proficiency.
About the job
Core Responsibilities
- Own the security posture of Palantir's Windows and Active Directory estate — hardening, configuration standards, and ongoing validation that those standards hold.
- Reduce attack surface across AD: audit and remediate misconfigurations, legacy protocol exposure, excessive privilege, Kerberos delegation abuse, and tier model violations.
- Evaluate, deploy, and own the configuration of defensive tooling across the Windows environment: EDR, PAM, identity threat detection, and endpoint hardening controls.
- Build and maintain automation for security operations across Windows infrastructure — patching pipelines, configuration drift monitoring, access reviews, and credential hygiene.
- Partner with Identity and Infrastructure teams to drive architectural improvements: tiered administration, Protected Users, LAPS, Credential Guard, and authentication policy silos.
- Translate findings from assessments and red team exercises into durable fixes — configuration changes, architectural improvements, and policy updates that reduce recurrence.
What We're Looking For
Active Directory
- Deep, working knowledge of AD architecture: sites and services, replication, trust relationships, delegation models, and the LDAP schema.
- Hands-on experience investigating and detecting AD attacks across the full kill chain — from initial enumeration through domain dominance.
- Familiarity with attack tooling (BloodHound, Impacket, Rubeus, Mimikatz, CrackMapExec) and, critically, what they leave behind.
- Experience hardening AD environments: tiered administration, Protected Users, LAPS, Credential Guard, PAM trusts, and authentication policy silos.
Windows Internals
- Thorough understanding of Windows security architecture: access tokens, privilege model, integrity levels, LSASS and credential storage, SAM, and the Security Reference Monitor.
- Ability to read and interpret Windows kernel structures, driver behavior, and undocumented APIs when necessary.
- Proficiency with low-level analysis tools: WinDbg, Process Monitor, Process Hacker, Volatility, and x64dbg.
- Experience with ETW-based telemetry pipelines and building detections on top of raw Windows event data.
Detection & Response
- Proven track record writing high-fidelity detection logic, not just tuning vendor signatures.
- Experience leading complex incident response investigations, including those involving nation-state or sophisticated criminal actors.
- Strong forensic fundamentals across disk, memory, and network artifacts on Windows systems.
What We Value
- Experience with Entra ID (Azure AD), hybrid identity architectures, and cloud-based attack paths that pivot through on-prem AD.
- Prior work in adversary simulation, red teaming, or offensive security research — especially against AD targets.
- Public contributions: conference talks (BlueHat, BSides, SANS, etc.), blog posts, or open-source tooling.
What We Require
- 5+ years of hands-on security experience, with the majority focused on Windows environments and Active Directory.
- Proficiency in Python or PowerShell for detection development, automation, and forensic tooling.
- Active TS/SCI security clearance, or eligibility and willingness to obtain one.
- A portfolio of real work: detections you've written, research you've published, tools you've built, or incidents you've led.
Skills
Active Directory, Windows, Edr, Pam, Bloodhound, Impacket, Rubeus, Mimikatz, Windbg, Process Monitor, PowerShell, Python, Kerberos, Etw, Azure Ad
Similar jobs
Security Engineering jobs
Datadog
New York, NY
Security Engineer on the Cyber Threat Intelligence team responsible for developing threat intel tooling, conducting threat hunting, analyzing malware, and operationalizing intelligence into detections and response workflows.
Stripe
United States
Designs and incubates technical defenses against complex abuse and fraud across Stripe’s payment, onboarding, identity, and Connect surfaces. Requires 3+ years of security or software engineering experience, strong production programming and SQL skills, and expertise in API safeguards and automated testing.
Fluidstack
New York, NYThe Security Engineer will track advanced adversaries targeting frontier AI infrastructure, build intelligence pipelines, conduct threat hunts, and create production detections. The role requires hands-on malware and infrastructure analysis, production programming, and close collaboration with detection and incident response teams.
Figma
San Francisco, CASecurity Scientist analyzing attacker and user behavior, building data-driven detections, and leading security investigations and design reviews. Requires strong security and anti-abuse knowledge, SQL fluency, scripting proficiency, and experience with distributed data systems and statistical methods.
hud
San Francisco, CA
Own and build the company’s security program as its first full-time security hire, covering product, cloud, infrastructure, incident response, compliance, and customer trust. The role requires hands-on security engineering and incident leadership, with experience operating SOC 2 or comparable frameworks.