Cyber Security Engineer

Job Description

Key responsibilities and qualifications include:

Design, implement, tune, and troubleshoot application whitelisting/application control policies across enterprise environments.
Experience with WDAC/App Control for Business, AppLocker, ThreatLocker, Airlock Digital, or comparable application control platforms.
Troubleshoot application execution blocks using endpoint telemetry, Windows event logs, application control events, and other diagnostic data.
Strong experience with Microsoft Defender for Endpoint and Defender Antivirus, including endpoint health, compliance monitoring, policy troubleshooting, AV/EDR exclusions, and remediation.
Experience supporting day-to-day Defender operations, including investigating security alerts, endpoint health issues, sensor/telemetry issues, malware detections, and protection-status discrepancies.
Experience troubleshooting Defender Antivirus and EDR behavior, including performance-related issues, policy conflicts, exclusions, scanning behavior, and endpoint onboarding or configuration issues.
Working knowledge of Defender security capabilities such as attack surface reduction, Controlled Folder Access, tamper protection, automated investigation/remediation, and endpoint detection and response.
Experience with KQL and Microsoft Defender Advanced Hunting for endpoint investigation, troubleshooting, compliance analysis, threat hunting, and validation.
Experience managing endpoint security policies through Microsoft Intune and MECM/SCCM, including deployment, targeting, testing, validation, and troubleshooting.
Working knowledge across Windows, macOS, and Linux, particularly Red Hat Enterprise Linux (RHEL) environments.
Knowledge of code signing, certificates, trusted publishers/signers, hashes, paths, and application trust models.
Experience with GitHub or similar source-control platforms for maintaining application control policies, scripts, documentation, versioning, and change history.
Experience with Ansible, PowerShell, and other scripting or automation technologies is highly desirable.
Experience supporting application control and endpoint security across workstations, servers, and VDI environments.
Strong understanding of cybersecurity fundamentals, including endpoint security, malware prevention, vulnerability management, least privilege, defense-in-depth, threat detection, and security control validation.
Ability to analyze security events and endpoint telemetry to distinguish malicious or suspicious activity from legitimate application and system behavior.
Ability to perform policy testing and validation, support phased deployments, document expected versus actual results, and assist with production rollout readiness and rollback planning.
Ability to develop and maintain runbooks, troubleshooting procedures, root-cause analysis documentation, operational checklists, change documentation, and audit evidence.
Strong communication and troubleshooting skills with the ability to work directly with application owners, platform engineering teams, infrastructure teams, and cybersecurity teams to investigate issues and develop practical remediation paths.