Application Control & Endpoint Security Engineer

247Hire

Vienna (VA)

On-site

USD 90,000 - 130,000

Full time

8 days ago

Get a reply from this employer

Your resume and cover letter, tailored to exactly what they’re hiring for.

Get past ATS filters

Job summary

247Hire is seeking a security-focused professional to design and manage application control policies across enterprise environments. You will work with WDAC/App Control platforms, Defender for Endpoint, and Intune/MECM to ensure compliant, secure operation across Windows, macOS, and Linux systems.

Responsibilities include troubleshooting policy blocks, investigating alerts, and validating protection status.

Qualifications

Experience with WDAC/App Control, AppLocker, ThreatLocker, Airlock Digital, or comparable application control platforms.
Strong experience with Microsoft Defender for Endpoint and Defender Antivirus, including endpoint health and policy troubleshooting.
Experience supporting Defender operations, alert investigations, endpoint health issues, sensor/telemetry issues, malware detections, and protection-status discrepancies.
Experience troubleshooting Defender Antivirus and EDR behavior, including performance issues, exclusions, scanning behavior, and onboarding.
Knowledge of Defender capabilities like attack surface reduction, Controlled Folder Access, tamper protection, automated investigation/remediation, and EDR.
Experience with KQL and Defender Advanced Hunting for investigation, troubleshooting, compliance analysis, threat hunting, and validation.
Experience managing endpoint security policies through Intune and MECM/SCCM, including deployment, targeting, testing, validation, and troubleshooting.
Working knowledge across Windows, macOS, and Linux (RHEL).
Understanding of code signing, certificates, trusted publishers/signers, hashes, paths, and application trust models.
Experience with GitHub or similar source-control platforms for policies, scripts, docs, versioning, and change history.
Experience with Ansible, PowerShell, and other scripting/automation is desirable.
Experience supporting application control and endpoint security across workstations, servers, and VDI environments.
Strong cybersecurity fundamentals: endpoint security, malware prevention, vulnerability management, least privilege, defense-in-depth, threat detection, and security control validation.
Ability to analyze security events and endpoint telemetry to distinguish malicious activity from legitimate behavior.
Ability to perform policy testing/validation, support phased deployments, document results, and assist with rollout readiness and rollback planning.
Ability to develop/runbooks, troubleshooting procedures, root-cause analysis, and audit evidence.
Strong communication and troubleshooting skills to work with application owners, platform engineering, infrastructure, and cybersecurity teams.

Responsibilities

Design, implement, tune, and troubleshoot application whitelisting policies across enterprise environments.
Troubleshoot application execution blocks using endpoint telemetry, Windows event logs, and policy events.
Support Defender for Endpoint operations, including investigating security alerts and addressing endpoint health issues.
Troubleshoot Defender Antivirus and EDR behavior, including performance, exclusions, and onboarding issues.
Work with Defender capabilities like attack surface reduction, Controlled Folder Access, tamper protection, automated investigations, and EDR.
Investigate with KQL/Defender Advanced Hunting for endpoint investigations and validation.
Manage endpoint security policies through Intune and MECM/SCCM, including deployment and testing.
Collaborate across Windows, macOS, and Linux (RHEL) environments to ensure policy effectiveness.
Maintain runbooks, troubleshooting procedures, root-cause analysis, operation checklists, and audit evidence.
Communicate with application owners, platform engineering, infrastructure, and cybersecurity teams to implement remediation paths.