Information Security Engineer

It started with a simple idea: what if surgery could be less invasive and recovery less painful? Nearly 30 years later, that question still fuels everything we do at Intuitive . As a global leader in robotic-assisted surgery and minimally invasive care , our technologies—like the da Vinci surgical system and Ion —have transformed how care is delivered for millions of patients worldwide. We’re a team of engineers, clinicians, and innovators united by one purpose: to make surgery smarter, safer, and more human. Every day, our work helps care teams perform with greater precision and patients recover faster, improving outcomes around the world. The problems we solve demand creativity, rigor, and collaboration. The work is challenging, but deeply meaningful—because every improvement we make has the potential to change a life. If you’re ready to contribute to something bigger than yourself and help transform the future of healthcare , you’ll find your purpose here. Primary Function of the Position This position operates within the IT Security organization and focuses on data loss prevention (DLP), endpoint detection and response (EDR), incident management orchestration, security automation, and zero trust network access (ZTNA). The analyst administers and tunes DLP policies, triages and responds to endpoint security events across Windows, macOS, and Linux, builds automated response workflows, and contributes to the continuous improvement of Intuitive’s security posture. Responsible for protecting company information, systems, and users from data exfiltration, unauthorized access, and threat exposure. Essential Job Duties  • Administer, tune, and maintain DLP policies and rules within enterprise DLP and SASE/CASB platforms to prevent unauthorized data exfiltration across endpoints, cloud applications, and network egress points.  • Deploy, configure, and troubleshoot EDR agents across Windows, macOS, and Linux endpoints, ensuring consistent sensor health, policy enforcement, and telemetry collection.  • Build and maintain automated incident response and orchestration workflows using SOAR platforms to accelerate alert triage, enrichment, containment, and escalation across the security tooling stack.  • Support ZTNA policy implementation and enforcement in coordination with Network Security, ensuring least-privilege access controls align with zero trust architecture principles.  • Investigate and respond to DLP alerts, performing root cause analysis, classifying data at risk, coordinating with business stakeholders on policy exceptions, and documenting findings for compliance and audit purposes.  • Triage and classify endpoint security events by severity and business impact, correlating telemetry from EDR, SIEM, and DLP platforms to identify threats and data exposure risks.  • Perform endpoint troubleshooting across Windows, macOS, and Linux, including agent deployment issues, policy conflicts, OS-specific behavioral anomalies, and sensor communication failures.  • Develop and refine operational metrics and dashboards in Elasticsearch to track DLP policy effectiveness, endpoint coverage gaps, automation ROI, and incident response performance.  • Collaborate with Detection Engineering to create and tune SIEM detection rules that address DLP bypass techniques, EDR evasion, and insider threat indicators.  • Partner with Incident Response and Investigations teams during escalated security events, providing endpoint forensic data, DLP event context, and automation support throughout the incident lifecycle.  • Conduct and support internal security investigations, including insider threat cases, policy violations, and unauthorized data handling, using DLP, EDR, and SIEM platforms for evidence collection and forensic analysis.  • Maintain strict confidentiality and discretion when handling sensitive investigation materials, personnel matters, and privileged findings throughout the investigative lifecycle.  Required Skills and Experience • Minimum of 2 years of experience. • Hands-on experience administering and tuning enterprise DLP and SASE/CASB solutions across endpoint, cloud, and network enforcement points.  • Experience deploying, managing, and troubleshooting EDR platforms across Windows, macOS, and Linux environments.  • Demonstrated competence in endpoint troubleshooting across Windows, macOS, and Linux, including agent lifecycle management, OS-level diagnostics, and policy conflict resolution.  • Understanding of underlying operating system internals for Windows, macOS, and Linux, including file systems, process management, registry/plist configuration, logging subsystems, and kernel-level behaviors relevant to security tooling.  • Working knowledge of ZTNA concepts and technologies, including identity-aware access controls, micro-segmentation, and least-privilege network policies.  • Experience building security automation and orchestration workflows using SOAR platforms to streamline incident triage, enrichment, and response.  • Familiarity with SIEM platforms and Elasticsearch for log analysis, alert correlation, and dashboard development.  • Strong communication skills with the ability to convey technical findings to IT teams, engineering stakeholders, and business partners in a matrixed organization. • Demonstrated ability to handle sensitive and confidential information with discretion, including investigation findings, personnel data, and legal hold materials. • Investigative mindset: intellectual curiosity, attention to detail, methodical evidence handling, objectivity, and the ability to construct a factual narrative from disparate data sources. Required Education and Training  Degree in a technical related field (or additional related experience) Working Conditions   None Preferred Skills and Experience  • Experience working within a SOC, incident response, or DLP operations function supporting enterprise-level environments.  • SANS/GIAC certifi