Carbon Black SME

Job Title Carbon Black SME

Location Remote

Duration 6 months

Interview Process Skype

Key Responsibilities:

• Evaluate the current Carbon Black deployment in the STS (Security Tools Standardization) environment, including reviewing the Las Vegas setup and leading installation/configuration in Reno.
• Connect and configure both Las Vegas and Reno servers to ensure replication and consistent operation.
• Collaborate with corporate IT to obtain and implement required policies and procedures, then transition management to the OT team.
• Reconfigure clients to point to the correct Carbon Black environment, developing a strategy for client migration and ensuring all endpoints are properly managed.
• Document the entire deployment, including configuration, policies, procedures, and future maintenance/update processes.
• Develop and document strategies for ongoing maintenance, patching, and deployment of new features or updates.
• Provide hands-on support, troubleshooting, and knowledge transfer to the internal team

Requirements: Carbon Black Architecture & Administration

• Serve as the Carbon Black subject matter expert to support architecture, design, implementation, and optimization.
• Explain and work with major Carbon Black components (agents, sensors, event pipeline, rules engine, policies, console internals).
• Build and manage notifications, policies, event views, approvals, and other daily operational workflows.
• Create, tune, and troubleshoot complex Expert Rules, Execution Control rules, File Control rules, and other rule types.

Migration, Upgrades & Environment Build

• Support the team in moving from an existing Carbon Black console to a new one.
• Clearly explain and execute what can be migrated, what must be rebuilt, and how to handle custom rules.
• Understand limitations of replication, clustering, and failover within Carbon Black environments.
• Provide technical guidance on agent install/uninstall/changeover during migrations.

Troubleshooting & Performance Engineering

• Diagnose and resolve high CPU issues, performance bottlenecks, agent instability, and other endpoint-level problems.
• Analyze event data to determine root causes and appropriate rule creation.
• Prevent outages by ensuring safe, tested rule deployment (one bad rule can disable systems).

Consultation & Team Enablement

• Support and mentor internal team members at various knowledge levels (junior admins to the internal expert).
• Help the team understand rule creation processes, event analysis, and policy tuning.
• Provide trusted guidance on best practices, architecture decisions, and security use cases.
• Assist the customer in interacting with Carbon Black/Broadcom support as needed.

Required Technical Skills Carbon Black Expertise (Must-Have)

• 5+ years hands-on experience administering and architecting Carbon Black App Control or Carbon Black Enterprise/EDR.

Deep understanding of:

• Console architecture
• Sensors/agents and communication paths
• Event processing
• Rule types (Expert, Execute Control, File Control, etc.)
• Policy tuning
• Notifications and approval workflows
• Experience migrating Carbon Black consoles or performing major upgrades.

Rule Creation & Event Analysis

• Ability to determine the correct rule type based on event data.
• Strong experience tuning false positives and handling sensitive rule deployment.
• Understanding of dependencies and risks (e.g., rules that can unintentionally block system processes).

Troubleshooting & Performance

• Strong experience diagnosing high CPU / performance issues related to Carbon Black agents and environment.
• Ability to perform advanced endpoint diagnostics (Windows and/or Linux depending on environment).
• Experience resolving large-scale rollout issues.

System Integration & Infrastructure Knowledge

• Understanding of clustering/HA concepts and the limitations within Carbon Black.
• Ability to explain why agents cannot point to multiple consoles without reinstall.
• Familiarity with server architecture, certificates, agent distribution, and network configuration.

Preferred Experience

• Previous work with Broadcom/Carbon Black Professional Services.
• Experience supporting enterprise security teams or SOC environments.
• Certifications in endpoint security or VMware/Carbon Black (if applicable).
• Experience with large-scale Windows server/endpoint fleets.