Lead Security Engineer - Workspace

About the role

Envestnet is looking for a Lead Security Engineer to strengthen the security of its enterprise endpoints, cloud‑managed devices, VDI, privileged workstations, developer environments, and SaaS‑connected workspaces. You will work in a hybrid/remote model from Trivandrum, collaborating with product, operations, and business teams to protect high‑risk environments and ensure compliance.

Key responsibilities

• Improve the security posture of enterprise endpoints, cloud‑managed devices, VDI, privileged workstations, developer environments, and SaaS‑connected workspaces.
• Reduce endpoint, identity, and data security risk by implementing controls that limit lateral movement, credential misuse, unmanaged device access, and exposure of sensitive data.
• Strengthen security for high‑risk user and engineering environments, including privileged access, development workflows, AI‑enabled tooling, and systems that process sensitive or regulated data.
• Support secure endpoint and workspace operations through policy enforcement, posture monitoring, automation, reporting, and remediation workflows.
• Partner cross‑functionally to align endpoint and workspace security controls with enterprise security standards, compliance expectations, and business needs.
• Maintain clear documentation, control evidence, runbooks, and operational procedures to support consistent execution and audit readiness.

Required profile

• Strong hands‑on experience securing and managing enterprise endpoint environments across Windows, macOS, Linux, VDI, remote workspaces, cloud‑managed devices, and developer workstations.
• Deep understanding of endpoint hardening, endpoint protection technologies, device management, security baselines, EDR/XDR, DLP, disk encryption, host firewalls, application control, Intune, Autopilot, and related tools.
• Understanding of identity‑based security controls, Conditional Access, device compliance, credential protection, token protection, and Zero Trust principles.
• Experience implementing or supporting endpoint data protection controls, including encryption, DLP, and CASB.

Required skills

• Windows
• macOS
• Linux
• VDI
• Cloud‑managed devices
• Developer workstations
• Endpoint hardening
• Endpoint protection
• Device management
• Security baselines
• EDR/XDR
• DLP
• Disk encryption
• Host firewalls
• Application control
• Microsoft Intune
• Autopilot
• Identity‑based security controls
• Conditional Access
• Device compliance
• Credential protection
• Token protection
• Zero Trust
• Encryption
• CASB