Cyber Security Engineer

System One; Merrifield (VA); Ibrido; USD 96.000 - 152.000; Tempo pieno

Descrizione del lavoro

System One, Inc. is seeking a Cybersecurity Engineer for a long-term contract. Remote or hybrid options are available in Vienna, VA, Winchester, VA, or Pensacola, FL. Ideal candidates have 8–10 years of professional experience in enterprise security.

The role emphasizes hands-on application whitelisting and Defender security solutions, including WDAC/App Control, AppLocker, ThreatLocker, or Airlock Digital, along with KQL-based investigations and policy management via Intune and MECM/SCCM.

Competenze

• 8–10 years of professional cybersecurity experience.
• Hands-on WDAC/App Control, AppLocker, ThreatLocker, or Airlock Digital experience.
• Strong Microsoft Defender for Endpoint and Defender Antivirus knowledge.
• Experience with KQL-based investigations and Defender Advanced Hunting.
• Policy management through Intune and MECM/SCCM; scripting/automation experience.

Mansioni

• Design, implement, tune, and troubleshoot application whitelisting policies across enterprise environments.
• Troubleshoot policy blocks using endpoint telemetry and Windows event logs.
• Manage Microsoft Defender for Endpoint and Defender Antivirus operations and remediation.
• Investigate security alerts, endpoint health, and telemetry issues.
• Collaborate with application owners and engineering teams to implement remediation paths.
• Develop runbooks, troubleshooting guides, and documentation.

Conoscenze

WDAC/App Control

AppLocker

ThreatLocker

Airlock Digital

KQL

Intune

MECM/SCCM

PowerShell

Automation scripting

Strumenti

Microsoft Defender for Endpoint

Defender Antivirus

GitHub

MECM/SCCM

Airlock Digital

Descrizione del lavoro

Title: Cybersecurity Engineer
Location: Remote or hybrid (Vienna, VA or Winchester, VA or Pensacola, FL)
Pay Rate: Open to W2 options (no c2c)
Position Type: Contract

We are currently seeking a Cybersecurity Engineer for a long term contracting position. This position can be either remote or hybrid in Vienna, VA or Winchester, VA or Pensacola, FL. We are ideally looking for candidates with 8-10 years of professional experience. We are able to work with W2 folks (no c2c).

Candidates must have a minimum of 5 years of direct, hands-on application whitelisting/application control experience with specific hands-on WDAC, AppLocker, ThreatLocker, or Airlock Digital experience. We are not looking for candidates whose backgrounds are limited to general SOC monitoring, vulnerability management, or standard endpoint security administration. In addition, hands-on Microsoft Defender expertise and KQL are required.

This role focuses on enterprise endpoint security operations, with a primary emphasis on implementing and managing application whitelisting/application control technologies and supporting Microsoft Defender security solutions. The engineer will design, configure, test, troubleshoot, and maintain application control policies using technologies such as Microsoft WDAC/App Control for Business, AppLocker, ThreatLocker, and Airlock Digital. Responsibilities also include investigating blocked applications, analyzing endpoint telemetry and Windows event logs, managing Microsoft Defender for Endpoint and Antivirus, and resolving endpoint security and compliance issues.

The position requires hands-on experience with endpoint security tools, policy management through Intune and MECM/SCCM, KQL-based investigations, and scripting or automation. The engineer will also support phased deployments, proof-of-concept initiatives, documentation, troubleshooting procedures, and collaboration with application owners, infrastructure teams, and cybersecurity stakeholders.

Seeking an experienced cybersecurity engineer to support enterprise Application Whitelisting/Application Control and daily endpoint security operations. The resource should have strong hands-on experience with Microsoft WDAC/App Control for Business, AppLocker, or other enterprise application whitelisting/application control technologies. Experience with ThreatLocker and/or Airlock Digital is highly desirable given upcoming proof-of-concept efforts.

Key responsibilities and qualifications include:

• Design, implement, tune, and troubleshoot application whitelisting/application control policies across enterprise environments.
• Experience with WDAC/App Control for Business, AppLocker, ThreatLocker, Airlock Digital, or comparable application control platforms.
• Troubleshoot application execution blocks using endpoint telemetry, Windows event logs, application control events, and other diagnostic data.
• Strong experience with Microsoft Defender for Endpoint and Defender Antivirus, including endpoint health, compliance monitoring, policy troubleshooting, AV/EDR exclusions, and remediation.
• Experience supporting day-to-day Defender operations, including investigating security alerts, endpoint health issues, sensor/telemetry issues, malware detections, and protection-status discrepancies.
• Experience troubleshooting Defender Antivirus and EDR behavior, including performance-related issues, policy conflicts, exclusions, scanning behavior, and endpoint onboarding or configuration issues.
• Working knowledge of Defender security capabilities such as attack surface reduction, Controlled Folder Access, tamper protection, automated investigation/remediation, and endpoint detection and response.
• Experience with KQL and Microsoft Defender Advanced Hunting for endpoint investigation, troubleshooting, compliance analysis, threat hunting, and validation.
• Experience managing endpoint security policies through Microsoft Intune and MECM/SCCM, including deployment, targeting, testing, validation, and troubleshooting.
• Working knowledge across Windows, macOS, and Linux, particularly Red Hat Enterprise Linux (RHEL) environments.
• Knowledge of code signing, certificates, trusted publishers/signers, hashes, paths, and application trust models.
• Experience with GitHub or similar source-control platforms for maintaining application control policies, scripts, documentation, versioning, and change history.
• Experience with Ansible, PowerShell, and other scripting or automation technologies is highly desirable.
• Experience supporting application control and endpoint security across workstations, servers, and VDI environments.
• Strong understanding of cybersecurity fundamentals, including endpoint security, malware prevention, vulnerability management, least privilege, defense-in-depth, threat detection, and security control validation.
• Ability to analyze security events and endpoint telemetry to distinguish malicious or suspicious activity from legitimate application and system behavior.
• Ability to perform policy testing and validation, support phased deployments, document expected versus actual results, and assist with production rollout readiness and rollback planning.
• Ability to develop and maintain runbooks, troubleshooting procedures, root-cause analysis documentation, operational checklists, change documentation, and audit evidence.
• Strong communication and troubleshooting skills with the ability to work directly with application owners, platform engineering teams, infrastructure teams, and cybersecurity teams to investigate issues and develop practical remediation paths.