Senior Cybersecurity Engineer – Endpoint Security (AI Enabled Operations)

This position requires office presence of a minimum of 5 days per week and is only located in the location(s) posted. No relocation is offered. Join AT&T and reimagine the communications and technologies that connect the world. Our Chief Security Office ensures that our assets are safeguarded through truthful transparency, enforce accountability and master cybersecurity to stay ahead of threats. Bring your bold ideas and fearless risk-taking to redefine connectivity and transform how the world shares stories and experiences that matter. When you step into a career with AT&T, you won’t just imagine the future-you’ll create it.

Summary We are seeking a Senior Cybersecurity Engineer to secure and modernize our enterprise endpoint security environment . The role will support broader endpoint security platforms such as EDR, DLP, VPN, secure web access, and endpoint visibility platforms. Across both mobile and endpoint domains, the role emphasizes AI‑enabled monitoring, analytics, triage, automation, and reporting to improve security outcomes while reducing operational overhead. This is a hands‑on engineering role operating at enterprise scale, working closely with Security Operations, Endpoint, IT, and business teams.

Support and help engineer endpoint security controls for: Endpoint Detection & Response (EDR) (e.g., SentinelOne, Microsoft Defender, Cortex XDR) Data Loss Prevention (DLP) (e.g., Microsoft Purview/Defender, Forcepoint) Remote Access VPN (e.g., Palo Alto GlobalProtect or equivalent) Proxy / Secure Web Access controls (endpoint agent and policy enforcement where applicable) Endpoint visibility, posture, and response platforms (e.g., Tanium or equivalent endpoint management and telemetry platforms) Additional responsibilities include: Provide Tier‑3 engineering support, including troubleshooting, policy tuning, exclusions, performance analysis, and vendor escalation. Standardize endpoint security baselines and deployment patterns to ensure consistent control coverage and user experience. Extend and adapt AI‑driven intake, enrichment, and approval workflows established in Mobile Security Operations to endpoint security use cases, including: Automated triage of endpoint security exceptions and access requests Correlation of endpoint posture, telemetry, and behavioral signals to defined risk criteria Generation of structured risk and justification summaries to support faster, more consistent decisions Design and maintain policy‑as‑code and AI‑assisted approval orchestration for endpoint controls, enabling: Fast‑track handling of low‑risk exceptions Escalation of high‑risk cases for engineering or security review Integration with EDR, DLP, VPN, proxy, endpoint visibility platforms, and ticketing systems to reduce operational friction and manual effort Apply AI‑assisted techniques for alert correlation, risk scoring, trend analysis, and control drift detection to continuously improve endpoint security operations. AI‑Enabled Security Modernization & Automation (Cross‑Cutting) Apply AI and analytics across mobile and endpoint security operations, including: AI‑assisted alert enrichment, correlation, and triage Risk scoring based on device posture, compliance, vulnerabilities, and behavioral signals Trend analysis for control coverage, health, drift, and recurring incidents Automated operational, compliance, and executive‑level reporting Develop or support automation using APIs and scripting to: Improve policy deployment and exception handling Accelerate incident response actions Reduce repetitive manual tasks and administrative overhead Cross‑Functional Collaboration & Operational Excellence Partner with Security Operations, Endpoint, IT, and business teams to align security controls with operational needs. Translate technical security requirements into clear, actionable guidance for technical and non‑technical stakeholders. Maintain runbooks, standards, and