Endpoint Detection and Response Engineer III

Department Overview

We are seeking an experienced Endpoint Detection and Response Engineer III to join our Cybersecurity Endpoint Protection team, focused on building and sustaining enterprise‑grade endpoint protection capabilities at global scale. This role emphasizes engineering rigor, platform reliability, and thoughtful implementation of endpoint security controls that reduce risk while enabling business operations. The Engineer III collaborates closely with Detection Engineering and other cybersecurity and technology teams to ensure endpoint controls generate high‑fidelity telemetry and integrate effectively into detection and response workflows. This role contributes hands‑on expertise, continuous improvement, and durable solutions across McDonald’s endpoint ecosystem.

Please note that this position in based in Chicago, Illinois, and follows a hybrid work schedule, requiring attendance in the office 3-4 days per week.

Duties

• Engineer, configure, and operate endpoint protection platforms and controls in alignment with established standards and architectures. 
• Assist in the continuous improvement and operational stability of endpoint protection services. 
• Collaborate closely with Detection Engineering to ensure endpoint telemetry supports high-quality detection use cases. 
• Implement preventative and hardening controls that reduce endpoint risk while maintaining business usability. 
• Contribute technical input into design discussions and improvement initiatives  
• Develop and maintain automation, scripts, and tooling to improve consistency and operational efficiency. 
• Troubleshoot complex endpoint protection issues and provide advanced technical support when escalated. 
• Maintain technical documentation, runbooks, and standard operating procedures related to endpoint protection controls. 
• Stay informed of emerging endpoint threats, trends, and technologies and share insights with the team. 

Qualifications

• 5+ years of experience in cybersecurity with a strong focus on endpoint protection engineering or operations. 
• Hands-on experience with enterprise endpoint protection or EDR/XDR platforms.
• Strong knowledge of Windows, macOS, and/or Linux endpoint operating systems. 
• Experience implementing and operating security controls at enterprise scale. 
• Proficiency in scripting or automation using tools such as PowerShell or Python. 
• Solid understanding of cybersecurity frameworks and models such as NIST, CIS Controls, and MITRE ATT&CK. 
• Experience and ability to participate in a 24x7x365 team. 
• Analyze sophisticated issues, detail their impact on the business, resolve their root causes, and identify corrective actions to prevent similar future events. 
• Super interpersonal skills, able to correspond with collaborators promptly and with attention to detail, vitality, and thoroughness to all levels of the organization. 
• Experience handling third-party vendors and service providers. 

Preferred Qualifications 

• 5+ years of experience designing, implementing, and operating enterprise scale endpoint protection and app control products across diverse global environments and operating systems.
• Demonstrated experience securing nontraditional and emerging endpoint platforms, including IoT devices, cloud hosted workloads, virtual machines, and containerized environments across major cloud providers (AWS, Azure, Google Cloud, OCI).  
• Experience supporting or enabling blue, purple, or red team activities through endpoint control engineering, telemetry improvements, and detection enablement.  
• Advanced proficiency in scripting and automation (e.g., Python, PowerShell) to operationalize controls, improve reliability, and reduce manual effort through engineering led solutions.  
• Strong experience integrating and extending security platforms via APIs, including REST and GraphQL, to enable automation, reporting, and ecosystem interoperability.  
• Proven ability to integrate endpoint protection platforms with IT Service Management systems (e.g., ServiceNow) to support operational workflows and escalation paths.  
• Experience leveraging data analysis and visualization tools (e.g., PowerBI, Tableau) to analyze endpoint trends, surface risk signals, and communicate technical insights effectively.  
• Working knowledge of the ITIL operating model, with an understanding of how endpoint protection engineering supports broader service operations.  
• Experience operating within Agile delivery models, contributing engineering work through iterative planning and execution.  
• Professional certifications such as CISSP, CISM, ITIL, or equivalent advanced security or engineering credentials. 

Salary Range

The expected salary range for this role is $138,207.00 - $172,758.00 USD per year
 
The above represents the expected salary range for this job requisition. Ultimately, in determining your pay, we may also consider your experience, and other job-related factors.