Hire remote security engineers for your MSP's security stack

Nobody owns the EDR coverage report

A security stack with no single owner drifts. The EDR agent is missing on a few endpoints at one client and an old policy exception sits at another. The MFA rollout finished for the easy tenants. The vulnerability scan runs and nobody works the report, and the hardening baseline lives in a document new clients never get. Your senior engineers know all of it, and escalations pull them off it every day.

The seat that fixes this is expensive to fill locally, and it gets deferred because the ticket queue always has a louder claim on the budget. Deferring it costs an MSP twice: it's the work that makes your security offering consistent across client tenants, and it's the work that lets a vCIO promise a client a remediation plan and know someone has the hours to deliver it. A dedicated engineer whose whole calendar is that backlog changes what you can sell.

What a remote security engineer works on

EDR and MDR tooling covers deployment, policy tuning and coverage checks across client tenants. Identity and access covers MFA rollouts, Conditional Access policy, privileged access and offboarding clean-up. Vulnerability management covers scans, prioritization and tracking fixes through your PSA. Then there are hardening baselines, and security assessments with the remediation projects that follow them.

The security side of client onboarding is a natural fit. When a new client cuts over, the engineer deploys agents, applies your baseline, checks the tenant against it, and records the result in whatever documentation platform you run. The engineer takes work from your PSA projects and service boards, submits changes through your own review process, and works the hours you agree with us. The engineer's legal employer is Dokimo's employer of record (EOR) partner, which runs their payroll in their own country.

What moves the price

The level of the work sets where a seat lands: the size of the stack and how many client tenants it owns. The calculator on the pricing page shows the price for each role and level. The price covers salary, legally required employer costs, employment through the EOR partner and the search, on one invoice. Licenses are yours.

Tested on a config, not on a conversation

Every candidate is tested on the real work before you meet them. For an engineering seat that is a live piece of your kind of work. It might be an EDR policy with gaps in it, a set of Conditional Access rules to review, a scan report to prioritize, or a baseline to pick apart. Talking well about detection or hardening doesn't get anyone through. Dokimo doesn't assume any candidate already knows your EDR, your identity setup or your scanner.

What matters is what the candidate flags, what they'd change first, what they'd leave alone on purpose, and how they write the change request. A good change note says what's changing, why, and how to back it out. Your review process and your client notes both depend on clear writing, and an engineer who can't explain a change clearly slows every review it goes through.

A security engineer holds privileged access to client tenants and to the tools that protect them, so a shared home machine or an unmanaged laptop is a risk you'd inherit. The optional secure remote workstation exists for that reason, and running the seat on a device or VDI you manage works too. Dokimo won't quote a time to shortlist.

Where a remote security engineer is the wrong answer

Client-facing advice and anything signed stay with your own people. The engineer prepares findings, drafts remediation plans and does the work. A person at your MSP reviews what goes to a client and puts a name on it, so a security assessment or an attestation shouldn't go out under the engineer's name. Physical work stays local too: swapping a firewall, cabling a rack, anything that needs hands in a building. A one-off deliverable, like a security assessment or a penetration test, is a consultancy job, and Dokimo doesn't sell one.

Regulated and US-only client environments are the harder line. Dokimo won't put a remote engineer on a client environment that holds export-controlled defense data, and it won't place one on a criminal justice system. Beyond those, the limits are contract or insurance terms that vary, and admin rights make them matter more, because one policy change in your EDR console can reach every endpoint in that tenant. HIPAA alone doesn't bar work from outside the US, but a client's agreement with you may go further. You decide which environments the seat touches.

Start a new international seat on client environments you've already cleared. Decide which consoles need a US-side approver for changes. The questions below cover how access should run, including the sign-in check. None of this is legal advice, and your agreements and your counsel make the call.