Cyber Security Engineer

Overview

We are seeking an experienced Cybersecurity Engineer to support enterprise application whitelisting, application control, and daily endpoint security operations. This role focuses on designing, implementing, maintaining, and troubleshooting application control policies while ensuring endpoint protection, security compliance, and operational stability across enterprise environments.

 

The Cybersecurity Engineer will work extensively with Microsoft Defender for Endpoint, Defender Antivirus, Microsoft WDAC/App Control for Business, AppLocker, and other enterprise application control technologies. The position will also support the evaluation and testing of emerging security solutions, including ThreatLocker and Airlock Digital.

 

The ideal candidate will have strong hands-on experience with endpoint security technologies, application control policy management, security investigations, and troubleshooting across Windows, macOS, and Linux environments. This role requires strong analytical skills, automation experience, and the ability to collaborate with application owners, infrastructure teams, and cybersecurity stakeholders to implement effective security controls while minimizing operational disruption.

 

Benefits:• Comprehensive Medical, Dental, and Vision Insurance• Employer-Paid Life Insurance• Employer-Paid Short-Term and Long-Term Disability Insurance• 401(k) • Paid Time Off (PTO) that includes Vacation Leave, Sick Leave, and 11 Paid Holidays• Educational Assistance

 

Salary: 120k-159k

 

**Can be 100% remote in TX, VA, MD, DC, or FL**

**High Profile roles may require candidates to fly to customer HQ for in person interview (expenses paid)**

 

Responsibilities

• Design, implement, maintain, tune, and troubleshoot enterprise application whitelisting and application control policies.

• Administer and support application control technologies, including Microsoft WDAC/App Control for Business, AppLocker, and comparable enterprise platforms.

• Support proof-of-concept evaluations and testing of application control solutions such as ThreatLocker and Airlock Digital.

• Investigate and resolve application execution blocks using endpoint telemetry, Windows event logs, application control events, and diagnostic tools.

• Administer and support Microsoft Defender for Endpoint and Defender Antivirus across enterprise environments.

• Monitor endpoint health, security compliance, protection status, and policy enforcement.

• Investigate and remediate endpoint security alerts, malware detections, sensor issues, telemetry gaps, and protection-status discrepancies.

• Troubleshoot Defender Antivirus and EDR issues involving performance, policy conflicts, exclusions, scanning behavior, and endpoint configuration.

• Configure, maintain, and troubleshoot endpoint security capabilities, including attack surface reduction, Controlled Folder Access, tamper protection, and automated investigation and remediation.

• Utilize Kusto Query Language (KQL) and Microsoft Defender Advanced Hunting to investigate endpoint activity, analyze security events, and validate security controls.

• Manage endpoint security policy deployment, targeting, testing, validation, and troubleshooting through Microsoft Intune and MECM/SCCM.

• Support endpoint security operations across Windows, macOS, and Linux systems, including Red Hat Enterprise Linux (RHEL).

• Evaluate application trust requirements involving code signing, certificates, trusted publishers, file hashes, and application paths.

• Maintain application control policies, scripts, documentation, and configuration history using GitHub or comparable source-control platforms.

• Develop and maintain PowerShell, Ansible, and other automation scripts to improve endpoint security operations and policy management.

• Support application control and endpoint security across workstations, servers, and virtual desktop infrastructure (VDI) environments.

• Analyze endpoint telemetry and security events to distinguish malicious or suspicious activity from legitimate application and system behavior.

• Perform application control policy testing and validation to identify potential compatibility issues and operational impacts.

• Support phased security policy deployments, production rollout readiness, and rollback planning.

• Document testing outcomes, including expected results, actual results, identified issues, and recommended corrective actions.

• Collaborate with application owners, platform engineering, infrastructure, and cybersecurity teams to investigate security issues and develop practical remediation solutions.

• Develop and maintain operational runbooks, troubleshooting procedures, root-cause analysis documentation, change records, and audit evidence.

• Support continuous improvement of endpoint security controls, operational processes, and application control standards.

• Perform other duties as assigned.

Qualifications

• Demonstrated experience in cybersecurity engineering, endpoint security administration, or a related information security discipline.

• Strong hands-on experience with enterprise application whitelisting and application control technologies.

• Experience implementing, configuring, and troubleshooting Microsoft WDAC/App Control for Business, AppLocker, or comparable application control platforms.

• Strong experience administering and troubleshooting Microsoft Defender for Endpoint and Defender Antivirus.

• Experience investigating endpoint security alerts, malware detections, endpoint health issues, and security policy enforcement failures.

• Experience troubleshooting endpoint detection and response (EDR) technologies, including sensor health, telemetry, exclusions, scanning behavior, and performance-related issues.

• Working knowledge of Microsoft Defender security capabilities, including attack surface reduction, Controlled Folder Access, tamper protection, and automated investigation and remediation.

• Experience using Kusto Query Language (KQL) and Microsoft Defender Advanced Hunting for security investigations, troubleshooting, compliance analysis, and threat hunting.

• Experience managing and deploying endpoint security policies through Microsoft Intune and MECM/SCCM.

• Working knowledge of Windows, macOS, and Linux operating systems, including Red Hat Enterprise Linux (RHEL).

• Understanding of application trust models, code signing, digital certificates, trusted publishers, file hashes, and path-based application control rules.

• Experience analyzing Windows event logs, application control events, and endpoint telemetry to identify and resolve security issues.

• Experience supporting endpoint security across workstations, servers, and virtual desktop infrastructure environments.

• Strong understanding of cybersecurity principles, including malware prevention, vulnerability management, least privilege, defense-in-depth, threat detection, and security control validation.

• Experience testing, validating, and troubleshooting security policies before enterprise deployment.

• Ability to support phased deployments, assess operational impacts, and develop rollback procedures.

• Experience using GitHub or similar source-control platforms to manage scripts, security policies, documentation, and configuration changes.

• Strong analytical, troubleshooting, critical-thinking, and root-cause analysis skills.

• Ability to distinguish legitimate application behavior from suspicious or malicious endpoint activity.

• Experience developing technical documentation, operational runbooks, troubleshooting guides, and change management records.

• Strong written and verbal communication skills.

• Ability to collaborate effectively with application owners, infrastructure teams, platform engineers, and cybersecurity stakeholders.

• Experience with ThreatLocker or Airlock Digital application control technologies highly preferred.

• Experience developing automation solutions using PowerShell, Ansible, or comparable scripting technologies preferred.

• Experience supporting application control proof-of-concept initiatives, enterprise security deployments, or endpoint security modernization efforts preferred.

** BRMi will not sponsor applicants for work visas for this position.**

**This is a W2 opportunity only**