Endpoint Protection Lead

Endpoint Protection Lead

Location: Milpitas, CA
Work Model: Onsite 4 days/week; fairly flexible when needed
Employment Type: Contract-to-Hire

Top Skills

1. USB Blocking / Device Control
2. CrowdStrike
3. Linux & Windows

Role Overview

We are seeking an Endpoint Protection Lead with deep hands-on expertise in endpoint data-egress control, particularly removable media and USB device access.

The role will design, deploy, and operationalize device-control policies across the endpoint fleet, including USB/removable-storage blocking, read-only and encryption-based exceptions, device allow-listing, and defensible exception workflows.

The candidate will also help control access to unapproved cloud-storage and file-sharing services using endpoint policies, browser/network controls, and CASB/SSE tooling.

Key Responsibilities

• Design and implement USB and removable-media controls
• Configure blocking, read-only, encryption, and allow-list policies
• Develop and manage endpoint security exceptions
• Work with Microsoft Defender for Endpoint and Microsoft Purview Device Control
• Manage CrowdStrike policies and endpoint protection
• Configure Microsoft 365 security controls
• Support controls for unapproved cloud storage and file-sharing services
• Partner with Data Protection teams and Cyera-based data discovery/DLP
• Own endpoint policy standards and phased rollout/enforcement
• Monitor blocked events and policy violations
• Continuously tune controls to close egress gaps while minimizing business disruption
• Support both Linux and Windows environments