Security Engineer II (Endpoint Security)

College Board - Technology - Security Location: This is a fully remote role. Candidates who live near CB offices have the option of being fully remote or hybrid (Tuesday and Wednesday in office). All CB employees are required to occasionally travel to meet in person for business purposes. Type: This is a full-time position About the Team Enterprise Security Engineering (ESE) is the security team responsible for building and operating the foundational security platforms and controls that protect College Board's enterprise environment. The team owns a broad capability surface spanning security observability, endpoint security, network and edge security, data security, security review management, and AI security. ESE is both an engineering team and a standards-setting function. The team designs, builds, and operates the controls that protect College Board's workforce, data, and systems, and it owns the enterprise security standards that operationalize information security policies across the organization. The team partners across security, Technology, and other organizational divisions to deliver integrated, measurable security outcomes. ESE engineers are technical owners who drive measurable risk reduction through automation, disciplined platform operations, and continuous improvement. About the Opportunity As a Security Engineer II, Endpoint Security, you will own the ongoing engineering of College Board's application allowlist, ensuring only approved software runs on managed endpoints. You will maintain and extend allowlist coverage as software, vendors, and business needs evolve, define and adjust policy as new device groups come online, and process exception requests as they arise. Application allowlisting is a standing control, not a one-time project - it requires continuous engineering to stay effective as the environment changes, and you will make an immediate impact by keeping enforcement current, accurate, and low-friction for the business. This role partners closely with IT, application owners, and business-unit stakeholders whose software needs must be captured and reflected in the allowlist on an ongoing basis. In this role, you will: Allowlist Policy Engineering and Coverage (50%) Maintain and extend the application allowlist baseline as software, vendors, and business needs change Define and adjust allowlist enforcement tiers and rollout sequencing as new device groups or business units come online Test and validate allowlist policy changes before enforcement to minimize business disruption Track and report on device coverage, blocked installs, and open risks Exception Handling and Policy Maintenance (30%) Process incoming software exception requests, validating business justification against approval criteria Maintain the allowlist as new, approved software and vendor updates are identified Monitor blocked-install attempts to identify gaps, over-broad restrictions, or emerging needs Maintain a knowledge base of allowlist decisions and precedent to support consistent handling of future requests Team Operations and Continuous Improvement (20%) Participate in team routines (planning, standups, retros) and contribute to process improvements Build and maintain documentation, checklists, and runbooks for allowlist policy and exception handling Conduct periodic audits/spot checks of allowlist adherence and exception documentation Continuously build endpoint security expertise through hands-on policy work and cross-team collaboration About you, you have: 2 to 4 years of experience in cybersecurity, endpoint security, IT operations, or a related technical role Working knowledge of endpoint management and application control concepts Hands-on experience processing exceptions or access requests against defined criteria, with attention to detail and comfort working with structured processes (tickets, checklists, exception workflows) Ability to communicate clearly with end users and business stakeholders about software approv