Head of Endpoint Defense

Who We Are

At Kyndryl, we design, build, manage and modernize the mission-critical technology systems that the world depends on every day. So why work at Kyndryl? We are always moving forward – always pushing ourselves to go further in our efforts to build a more equitable, inclusive world for our employees, our customers and our communities.

The Role

Role Purpose

Leads Kyndryl's endpoint defense function, owning the operation, tuning, and coverage of the endpoint detection and response estate across Palo Alto Cortex XDR, Microsoft Defender for Endpoint, Trend Micro, and additional endpoint tooling. Ensures consistent prevention, detection, and telemetry quality across a heterogeneous, multi-vendor fleet, and that endpoint signal feeds the detection pipeline cleanly. Runs the function as a platform service to Cyber Defense, not as an independent detection authority.

Key Responsibilities

• Own operations, policy, and health for the endpoint defense estate: Cortex XDR, Microsoft Defender for Endpoint, Trend Micro, and other endpoint tooling.
• Drive agent coverage, deployment, and configuration integrity across the managed fleet, closing gaps in visibility.
• Tune prevention and detection policy to balance efficacy against operational disruption, in partnership with Cyber Defense and SIEM/SOAR.
• Rationalize the multi-vendor endpoint stack toward consistent coverage and reduced overlap, with a defensible consolidation or coexistence posture.
• Ensure endpoint telemetry is complete, timely, and correctly integrated into XSIAM and the detection pipeline.
• Support incident response with endpoint containment, isolation, and forensic data on demand from the Incident Commander.
• Drive automation for agent deployment, health monitoring, policy management, remediation actions, and telemetry quality to reduce operational overhead and improve response times.
• Establish and report on endpoint security KPIs, including coverage, agent health,