Security Engineer II (Endpoint Security)

College Board - Technology - Security

Location:This is a fully remote role. Candidates who live near CB offices have the option of being fully remote or hybrid (Tuesday and Wednesday in office). All CB employees are required to occasionally travel to meet in person for business purposes.

Type:This is a full-time position

About the Team

Enterprise Security Engineering (ESE) is the security team responsible for building and operating the foundational security platforms and controls that protect College Board's enterprise environment. The team owns a broad capability surface spanning security observability, endpoint security, network and edge security, data security, security review management, and AI security.

ESE is both an engineering team and a standards-setting function. The team designs, builds, and operates the controls that protect College Board's workforce, data, and systems, and it owns the enterprise security standards that operationalize information security policies across the organization.

The team partners across security, Technology, and other organizational divisions to deliver integrated, measurable security outcomes. ESE engineers are technical owners who drive measurable risk reduction through automation, disciplined platform operations, and continuous improvement.

About the Opportunity

As a Security Engineer II, Endpoint Security, you will own the ongoing engineering of College Board's application allowlist, ensuring only approved software runs on managed endpoints. You will maintain and extend allowlist coverage as software, vendors, and business needs evolve, define and adjust policy as new device groups come online, and process exception requests as they arise. Application allowlisting is a standing control, not a one-time project — it requires continuous engineering to stay effective as the environment changes, and you will make an immediate impact by keeping enforcement current, accurate, and low-friction for the business.

This role partners closely with IT, application owners, and business-unit stakeholders whose software needs must be captured and reflected in the allowlist on an ongoing basis.

In this role, you will:

Allowlist Policy Engineering and Coverage (50%)

• Maintain and extend the application allowlist baseline as software, vendors, and business needs change
• Define and adjust allowlist enforcement tiers and rollout sequencing as new device groups or business units come online
• Test and validate allowlist policy changes before enforcement to minimize business disruption
• Track and report on device coverage, blocked installs, and open risks

Exception Handling and Policy Maintenance (30%)

• Process incoming software exception requests, validating business justification against approval criteria
• Maintain the allowlist as new, approved software and vendor updates are identified
• Monitor blocked-install attempts to identify gaps, over-broad restrictions, or emerging needs
• Maintain a knowledge base of allowlist decisions and precedent to support consistent handling of future requests

Team Operations and Continuous Improvement (20%)

• Participate in team routines (planning, standups, retros) and contribute to process improvements
• Build and maintain documentation, checklists, and runbooks for allowlist policy and exception handling
• Conduct periodic audits/spot checks of allowlist adherence and exception documentation
• Continuously build endpoint security expertise through hands-on policy work and cross-team collaboration

About you, you have:

• 2 to 4 years of experience in cybersecurity, endpoint security, IT operations, or a related technical role
• Working knowledge of endpoint management and application control concepts
• Hands-on experience processing exceptions or access requests against defined criteria, with attention to detail and comfort working with structured processes (tickets, checklists, exception workflows)
• Ability to communicate clearly with end users and business stakeholders about software approvals and restrictions
• Strong organizational and documentation skills, with the discipline to keep records accurate and audit-ready
• Ability and enthusiasm to learn new security tools and technologies as required
• Authorization to work in the United States.

Nice to have:

• 1+ years of software or scripting experience (Python, PowerShell, or similar) to support automation of allowlist management or reporting
• Experience with endpoint management or application control platforms (e.g., Intune, Tanium, Carbon Black, AppLocker)
• Exposure to IT service management/ticketing platforms (e.g., ServiceNow)
• Relevant certifications (Security+, or an endpoint/EDR vendor certification)
• Experience working in a regulated or audited environment (e.g., SOX, HIPAA, PCI)

All roles at College Board require:

• A passion for expanding educational and career opportunities and mission-driven work
• Authorization to work in the United States for any employer
• Curiosity and enthusiasm for emerging technologies, with a willingness to experiment with and adopt new solutions and a comfort learning and applying new digital tools independently and proactively.
• Clear and concise communication skills, written and verbal
• A learner's mindset and a commitment to growth: welcoming diverse perspectives, giving and receiving timely, respectful feedback, and continuously improving through iterative learning and user input.
• A drive for impact and excellence: solving complex problems, making data-informed decisions, prioritizing what matters most, and continuously improving through learning, user input, and external benchmarking.
• A collaborative and empathetic approach: working across differences, fostering trust, and contributing to a culture of shared success.

About Our Process

• Application review will begin immediately and will continue until the position is filled. This role is expected to accept applications for a minimum of 5 business days.
• While thehiring process may vary, it generally includes: resume and application submission, recruiter phone/video screen, hiring manager interview, a practical exercise, a panel interview, a conversation with leadership and reference checks.

What We Offer

At College Board, we offer more than just a paycheck—we provide a meaningful career, a supportive team, and a comprehensive package designed to help you thrive. We're a self-sustaining nonprofit that believes in fair and competitive compensation, grounded in your qualifications, experience, impact, and the market.

A Thoughtful Approach to Compensation

• The hiring range for this role is $116,000 - $125,000
• Your exact salary will depend on your location, experience, and how your background compares to others in similar roles at the College Board.
• We aim to make our best offer upfront—rooted in fairness, transparency, and market data.
• We adjust salaries by location to ensure fairness, no matter where you live.

You'll have open, transparent conversations about compensation, benefits, and what it's like to work at College Board throughout your hiring process. Check out our careers page for more.

#LI-DC1

#LI-REMOTE