Service Reliability Engineer
CFC
1 day ago
Full-time
Remote
Automation
We are looking for a mid-level Service Reliability Engineer to own the health and reliability of the tooling that powers our managed detection and response (MDR) service — agents, connectors, and the XDR platform itself. Rather than focusing on backend infrastructure uptime, this role is about making sure the sensors and data feeds our SOC depends on are deployed correctly, stay healthy, and keep flowing across every customer environment. You'll be the person who notices when an agent goes silent, a connector stops pulling logs, or a customer's deployment drifted out of policy — and who fixes it before it becomes a detection gap.
This role is a strong fit for someone who enjoys operational problem-solving across a large multi-tenant fleet, is comfortable digging into vendor platforms, and wants to directly improve detection coverage through better tooling hygiene.
This role is a strong fit for someone who enjoys operational problem-solving across a large multi-tenant fleet, is comfortable digging into vendor platforms, and wants to directly improve detection coverage through better tooling hygiene.
About the role
- Validate that EDR/XDR agents and sensors are deployed correctly across customer endpoints, servers, and cloud workloads, and remediate incomplete or failed deployments.
- Monitor agent health across the customer fleet — heartbeat failures, offline or stale agents, version drift, tamper alerts, and policy misconfigurations — and drive issues to resolution.
- Monitor connector and integration health (log sources, API-based connectors, cloud data feeds) into the XDR/SIEM platform, and troubleshoot broken or stalled data ingestion.
- Tune the XDR platform's detection and correlation rules to reduce false positives and alert noise while preserving detection coverage.
- Identify and close data source coverage gaps by working with customers and internal teams to onboard missing log sources or reconfigure existing connectors.
- Build dashboards and alerting to give the team real-time visibility into agent and connector health across all customer environments.
- Partner with SOC analysts and detection engineers to identify when tooling gaps (silent agents, broken connectors, misconfigured policies) are creating detection blind spots.
- Maintain deployment and troubleshooting runbooks for agents, connectors, and platform tuning to support consistent handling across the team.
- Escalate and track platform-level issues with EDR/XDR/SIEM vendors when a fix falls outside our control.
- Report on fleet-wide health metrics (agent uptime, connector uptime, deployment completeness) and recommend proactive improvements.
About you
- 3–5 years of experience deploying, administering, or supporting EDR/XDR or SIEM agents and connectors in a production environment.
- Hands-on experience with agent-based security tooling — understanding of sensor architecture, heartbeats, policy management, and tamper protection.
- Experience with connector/integration health for log sources and data feeds (syslog, API-based connectors, cloud log sources such as AWS CloudTrail, Azure, or Microsoft 365).
- Experience tuning detection or correlation rules on a SIEM/XDR platform to reduce noise without sacrificing coverage.
- Scripting/automation experience (Python, PowerShell, or Bash) to build health checks and reduce manual monitoring toil.
- Strong troubleshooting skills across Windows, Linux, and macOS endpoints, plus general networking and cloud connectivity.
- Comfortable managing and reporting on tooling health across a large, multi-tenant customer fleet.
- Comfortable participating in a rotating on-call or escalation schedule as needed.