Cyber Security Engineer

We are seeking an experienced Cybersecurity Engineer to support enterprise application whitelisting, application control, and daily endpoint security operations. This role focuses on designing, implementing, maintaining, and troubleshooting application control policies while ensuring endpoint protection, security compliance, and operational stability across enterprise environments.

The Cybersecurity Engineer will work extensively with Microsoft Defender for Endpoint, Defender Antivirus, Microsoft WDAC/App Control for Business, App Locker, and other enterprise application control technologies. The position will also support the evaluation and testing of emerging security solutions, including Threat Locker and Airlock Digital.

The ideal candidate will have strong hands-on experience with endpoint security technologies, application control policy management, security investigations, and troubleshooting across Windows, macOS, and Linux environments. This role requires strong analytical skills, automation experience, and the ability to collaborate with application owners, infrastructure teams, and cybersecurity stakeholders to implement effective security controls while minimizing operational disruption.

Benefits:
Comprehensive Medical, Dental, and Vision Insurance Employer-Paid Life Insurance Employer-Paid Short-Term and Long-Term Disability Insurance 401(k) Paid Time Off (PTO) that includes Vacation Leave, Sick Leave, and 11 Paid Holidays Educational Assistance

Salary: 120k-159k

** Can be 100% remote in TX, VA, MD, DC, or FL**

** High Profile roles may require candidates to fly to customer HQ for in person interview (expenses paid)**

• Design, implement, maintain, tune, and troubleshoot enterprise application whitelisting and application control policies.

• Administer and support application control technologies, including Microsoft WDAC/App Control for Business, App Locker, and comparable enterprise platforms.

• Support proof-of-concept evaluations and testing of application control solutions such as Threat Locker and Airlock Digital.

• Investigate and resolve application execution blocks using endpoint telemetry, Windows event logs, application control events, and diagnostic tools.

• Administer and support Microsoft Defender for Endpoint and Defender Antivirus across enterprise environments.

• Monitor endpoint health, security compliance, protection status, and policy enforcement.

• Investigate and remediate endpoint security alerts, malware detections, sensor issues, telemetry gaps, and protection-status discrepancies.

• Troubleshoot Defender Antivirus and EDR issues involving performance, policy conflicts, exclusions, scanning behavior, and endpoint configuration.

• Configure, maintain, and troubleshoot endpoint security capabilities, including attack surface reduction, Controlled Folder Access, tamper protection, and automated investigation and remediation.

• Utilize Kusto Query Language (KQL) and Microsoft Defender Advanced Hunting to investigate endpoint activity, analyze security events, and validate security controls.

• Manage endpoint security policy deployment, targeting, testing, validation, and troubleshooting through Microsoft Intune and MECM/SCCM.

• Support endpoint security operations across Windows, macOS, and Linux systems, including Red Hat Enterprise Linux (RHEL).

• Evaluate application trust requirements involving code signing, certificates, trusted publishers, file hashes, and application paths.

• Maintain application control policies, scripts, documentation, and configuration history using Git Hub or comparable source-control platforms.

• Develop and maintain Power Shell, Ansible, and other automation scripts to improve endpoint security operations and policy management.

• Support application control and endpoint security across workstations, servers, and virtual desktop infrastructure (VDI) environments.

• Analyze endpoint telemetry and security events to distinguish malicious or suspicious activity from legitimate application and system behavior.

• Perform application control policy testing and validation to identify potential compatibility issues and operational impacts.

• Support phased security policy deployments, production rollout readiness, and rollback planning.

• Document testing outcomes, including expected results, actual results, identified issues, and recommended corrective actions.

• Collaborate with application owners, platform engineering, infrastructure, and cybersecurity teams to investigate security issues and develop…