System Engineer

System Engineer
6 Months+ contract initially + Extensions
Based:
Onsite in Abingdon, Oxford
Rate - £300 - £400 p/d via Umbrella

We have a great opportunity with a world leading organisation where you will be provided with all of the support and development to succeed. A progressive organisation where you can really make a difference. We have a great opportunity for a number of System Engineers on a long term program of work.

• Support the design, testing, and execution of the Non‑Attributable Account (NAA) remediation program across RC4‑dependent and non‑RC4‑dependent account types.
• Assist in building, maintaining, and activating host allow/deny lists within the Lab Organizational Unit (OU) in Active Directory.
• Coordinate with Info Sec and AD teams to execute password reset mechanisms and validate outcomes across pilot and full‑rollout phases.
• Engage Business System Owners and lab staff to identify NAA usage patterns, confirm active engagements, and support transition to properly managed service accounts.
• Support deployment and configuration of Transparent Screen Lock and Beyond Trust (password management and remote access) as replacement mechanisms for NAA‑dependent workflows.

• Assist in defining and implementing a policy‑based software allow list across lab workstations and instrument PCs in the Lab OU.
• Identify currently installed unauthorized or unlicensed software across lab endpoints and support remediation planning.
• Develop and maintain a formal exception request process for legitimate scientific software deployment needs.

• Support Crowd Strike EDR sensor deployment and gap closure across lab endpoints, coordinating with Info Sec and site partners.
• Identify and remediate open or misconfigured file shares presenting lateral movement and data exfiltration risk.
• Contribute to OS patching cadence and compliance tracking for lab workstations and instrument PCs.
• Assist in end‑of‑life operating system identification, remediation planning, and isolation strategies across lab infrastructure.
• Support server‑level vulnerability triage and remediation in coordination with the infrastructure team.

• Assess current USB usage patterns across lab sites and instrument workflows.
• Assist in defining and implementing a tiered USB restriction policy (block, monitor, allow‑by‑exception) that protects the environment without impeding legitimate scientific workflows.
• Manage the formal USB exception process for vendor‑mediated access scenarios.

• Serve as a hands‑on technical resource for site partners across Boston/US, Oxford/UK, and other global lab locations.
• Maintain accurate documentation of system configurations, allow/deny lists, service account inventories, and workstream progress.
• Contribute to demand intake and Service Now‑based request management for new service account and access requests.
• Participate in hyper‑care periods following major changes, providing rapid response to connectivity or authentication issues.
• Communicate clearly with both technical and non‑technical stakeholders, including lab scientists, Business System Owners, and senior leadership.

• Proficiency in Active Directory administration: OU structure, Group Policy Objects (GPOs), user/service account management, and authentication protocols including RC4/NTLM/Kerberos.
• Understanding of allow/deny list enforcement mechanisms within AD and Lab OU environments.
• Experience with service account lifecycle management and privileged access controls.
• Understanding of enterprise Identity Management tools (Sailpoint).
• Working knowledge of endpoint detection and response (EDR) platforms, particularly Crowd Strike Falcon.
• Understanding of OT/lab network architecture, including isolated or semi‑isolated lab network segments, instrument connectivity, and associated security risks.
• Familiarity with USB restriction and software control policies on Windows endpoints.
• Knowledge of vulnerability management concepts: OS patching, EOL systems, open file shares, and network‑level…