Service Reliability Engineer

Department: Global Security Services

Employment Type: Permanent - Full Time

Location: n/a, United States, Remote, Hybrid

About the role

• Validate that EDR/XDR agents and sensors are deployed correctly across customer endpoints, servers, and cloud workloads, and remediate incomplete or failed deployments.
• Monitor agent health across the customer fleet — heartbeat failures, offline or stale agents, version drift, tamper alerts, and policy misconfigurations — and drive issues to resolution.
• Monitor connector and integration health (log sources, API-based connectors, cloud data feeds) into the XDR/SIEM platform, and troubleshoot broken or stalled data ingestion.
• Tune the XDR platform's detection and correlation rules to reduce false positives and alert noise while preserving detection coverage.
• Identify and close data source coverage gaps by working with customers and internal teams to onboard missing log sources or reconfigure existing connectors.
• Build dashboards and alerting to give the team real-time visibility into agent and connector health across all customer environments.
• Partner with SOC analysts and detection engineers to identify when tooling gaps (silent agents, broken connectors, misconfigured policies) are creating detection blind spots.
• Maintain deployment and troubleshooting runbooks for agents, connectors, and platform tuning to support consistent handling across the team.
• Escalate and track platform-level issues with EDR/XDR/SIEM vendors when a fix falls outside our control.
• Report on fleet-wide health metrics (agent uptime, connector uptime, deployment completeness) and recommend proactive improvements.

About you

• 3–5 years of experience deploying, administering, or supporting EDR/XDR or SIEM agents and connectors in a production environment.
• Hands-on experience with agent-based security tooling — understanding of sensor architecture, heartbeats, policy management, and tamper protection.
• Experience with connector/integration health for log sources and data feeds (syslog, API-based connectors, cloud log sources such as AWS CloudTrail, Azure, or Microsoft 365).
• Experience tuning detection or correlation rules on a SIEM/XDR platform to reduce noise without sacrificing coverage.
• Scripting/automation experience (Python, PowerShell, or Bash) to build health checks and reduce manual monitoring toil.
• Strong troubleshooting skills across Windows, Linux, and macOS endpoints, plus general networking and cloud connectivity.
• Comfortable managing and reporting on tooling health across a large, multi-tenant customer fleet.
• Comfortable participating in a rotating on-call or escalation schedule as needed.