Cyber Security Engineer

Description

Seeking an experienced Cybersecurity Engineer to support enterprise Application listing/Application Control and daily Endpoint Security operations. The resource should have strong hands-on experience with Microsoft WDAC/App Control for Business, AppLocker, or other enterprise application listing/application control technologies. Experience with ThreatLocker and/or Airlock Digital is highly desirable given upcoming proof-of-concept efforts.

Key Responsibilities and Qualifications

• Design, implement, tune, and troubleshoot application listing/application control policies across enterprise environments.

• Experience with WDAC/App Control for Business, AppLocker, ThreatLocker, Airlock Digital, or comparable application control platforms.

• Troubleshoot application execution blocks using endpoint telemetry, Windows event logs, application control events, and other diagnostic data.

• Strong experience with Microsoft Defender for Endpoint and Defender Antivirus, including endpoint health, compliance monitoring, policy troubleshooting, AV/EDR exclusions, and remediation.

• Experience supporting day-to-day Defender operations, including investigating security alerts, endpoint health issues, sensor/telemetry issues, malware detections, and protection-status discrepancies.

• Experience troubleshooting Defender Antivirus and EDR behavior, including performance-related issues, policy conflicts, exclusions, scanning behavior, and endpoint onboarding or configuration issues.

• Working knowledge of Defender security capabilities such as attack surface reduction, Controlled Folder Access, tamper protection, automated investigation/remediation, and endpoint detection and response.

• Experience with KQL and Microsoft Defender Advanced Hunting for endpoint investigation, troubleshooting, compliance analysis, threat hunting, and validation.

• Experience managing endpoint security policies through Microsoft Intune and MECM/SCCM, including deployment, targeting, testing, validation, and troubleshooting.

• Working knowledge across Windows, macOS, and Linux, particularly Red Hat Enterprise Linux (RHEL) environments.

• Knowledge of code signing, certificates, trusted publishers/signers, hashes, paths, and application trust models.

• Experience with GitHub or similar source-control platforms for maintaining application control policies, scripts, documentation, versioning, and change history.

• Experience with Ansible, PowerShell, and other scripting or automation technologies is highly desirable.

• Experience supporting application control and endpoint security across workstations, servers, and VDI environments.

• Strong understanding of cybersecurity fundamentals, including endpoint security, malware prevention, vulnerability management, least privilege, defense-in-depth, threat detection, and security control validation.

• Ability to analyze security events and endpoint telemetry to distinguish malicious or suspicious activity from legitimate application and system behavior.

• Ability to perform policy testing and validation, support phased deployments, document expected versus actual results, and assist with production rollout readiness and rollback planning.

• Ability to develop and maintain runbooks, troubleshooting procedures, root-cause analysis documentation, operational checklists, change documentation, and audit evidence.

• Strong communication and troubleshooting skills, with the ability to work directly with application owners, platform engineering teams, infrastructure teams, and cybersecurity teams to investigate issues and develop practical remediation paths.