Cyber Security Engineer

247Hire; Vienna (VA); In loco; USD 90.000 - 130.000; Tempo pieno

Descrizione del lavoro

247Hire is seeking a security-focused professional to design and manage application control policies across enterprise environments. You will work with WDAC/App Control platforms, Defender for Endpoint, and Intune/MECM to ensure compliant, secure operation across Windows, macOS, and Linux systems.

Responsibilities include troubleshooting policy blocks, investigating alerts, and validating protection status.

Competenze

• Experience with WDAC/App Control, AppLocker, ThreatLocker, Airlock Digital, or comparable application control platforms.
• Strong experience with Microsoft Defender for Endpoint and Defender Antivirus, including endpoint health and policy troubleshooting.
• Experience supporting Defender operations, alert investigations, endpoint health issues, sensor/telemetry issues, malware detections, and protection-status discrepancies.
• Experience troubleshooting Defender Antivirus and EDR behavior, including performance issues, exclusions, scanning behavior, and onboarding.
• Knowledge of Defender capabilities like attack surface reduction, Controlled Folder Access, tamper protection, automated investigation/remediation, and EDR.
• Experience with KQL and Defender Advanced Hunting for investigation, troubleshooting, compliance analysis, threat hunting, and validation.
• Experience managing endpoint security policies through Intune and MECM/SCCM, including deployment, targeting, testing, validation, and troubleshooting.
• Working knowledge across Windows, macOS, and Linux (RHEL).
• Understanding of code signing, certificates, trusted publishers/signers, hashes, paths, and application trust models.
• Experience with GitHub or similar source-control platforms for policies, scripts, docs, versioning, and change history.
• Experience with Ansible, PowerShell, and other scripting/automation is desirable.
• Experience supporting application control and endpoint security across workstations, servers, and VDI environments.
• Strong cybersecurity fundamentals: endpoint security, malware prevention, vulnerability management, least privilege, defense-in-depth, threat detection, and security control validation.
• Ability to analyze security events and endpoint telemetry to distinguish malicious activity from legitimate behavior.
• Ability to perform policy testing/validation, support phased deployments, document results, and assist with rollout readiness and rollback planning.
• Ability to develop/runbooks, troubleshooting procedures, root-cause analysis, and audit evidence.
• Strong communication and troubleshooting skills to work with application owners, platform engineering, infrastructure, and cybersecurity teams.

Mansioni

• Design, implement, tune, and troubleshoot application whitelisting policies across enterprise environments.
• Troubleshoot application execution blocks using endpoint telemetry, Windows event logs, and policy events.
• Support Defender for Endpoint operations, including investigating security alerts and addressing endpoint health issues.
• Troubleshoot Defender Antivirus and EDR behavior, including performance, exclusions, and onboarding issues.
• Work with Defender capabilities like attack surface reduction, Controlled Folder Access, tamper protection, automated investigations, and EDR.
• Investigate with KQL/Defender Advanced Hunting for endpoint investigations and validation.
• Manage endpoint security policies through Intune and MECM/SCCM, including deployment and testing.
• Collaborate across Windows, macOS, and Linux (RHEL) environments to ensure policy effectiveness.
• Maintain runbooks, troubleshooting procedures, root-cause analysis, operation checklists, and audit evidence.
• Communicate with application owners, platform engineering, infrastructure, and cybersecurity teams to implement remediation paths.

Conoscenze

WDAC/App Control

AppLocker

Defender for Endpoint

KQL / Defender Advanced Hunting

Intune / MECM / SCCM

Cross-Platform (Windows/macOS/Linux)

GitHub / versioning

PowerShell / Ansible

Strumenti

GitHub

PowerShell

Ansible

Intune

MECM/SCCM

Defender for Endpoint

Descrizione del lavoro

Key responsibilities and qualifications include:

• Design, implement, tune, and troubleshoot application whitelisting/application control policies across enterprise environments.
• Experience with WDAC/App Control for Business, AppLocker, ThreatLocker, Airlock Digital, or comparable application control platforms.
• Troubleshoot application execution blocks using endpoint telemetry, Windows event logs, application control events, and other diagnostic data.
• Strong experience with Microsoft Defender for Endpoint and Defender Antivirus, including endpoint health, compliance monitoring, policy troubleshooting, AV/EDR exclusions, and remediation.
• Experience supporting day-to-day Defender operations, including investigating security alerts, endpoint health issues, sensor/telemetry issues, malware detections, and protection-status discrepancies.
• Experience troubleshooting Defender Antivirus and EDR behavior, including performance-related issues, policy conflicts, exclusions, scanning behavior, and endpoint onboarding or configuration issues.
• Working knowledge of Defender security capabilities such as attack surface reduction, Controlled Folder Access, tamper protection, automated investigation/remediation, and endpoint detection and response.
• Experience with KQL and Microsoft Defender Advanced Hunting for endpoint investigation, troubleshooting, compliance analysis, threat hunting, and validation.
• Experience managing endpoint security policies through Microsoft Intune and MECM/SCCM, including deployment, targeting, testing, validation, and troubleshooting.
• Working knowledge across Windows, macOS, and Linux, particularly Red Hat Enterprise Linux (RHEL) environments.
• Knowledge of code signing, certificates, trusted publishers/signers, hashes, paths, and application trust models.
• Experience with GitHub or similar source-control platforms for maintaining application control policies, scripts, documentation, versioning, and change history.
• Experience with Ansible, PowerShell, and other scripting or automation technologies is highly desirable.
• Experience supporting application control and endpoint security across workstations, servers, and VDI environments.
• Strong understanding of cybersecurity fundamentals, including endpoint security, malware prevention, vulnerability management, least privilege, defense-in-depth, threat detection, and security control validation.
• Ability to analyze security events and endpoint telemetry to distinguish malicious or suspicious activity from legitimate application and system behavior.
• Ability to perform policy testing and validation, support phased deployments, document expected versus actual results, and assist with production rollout readiness and rollback planning.
• Ability to develop and maintain runbooks, troubleshooting procedures, root-cause analysis documentation, operational checklists, change documentation, and audit evidence.
• Strong communication and troubleshooting skills with the ability to work directly with application owners, platform engineering teams, infrastructure teams, and cybersecurity teams to investigate issues and develop practical remediation paths.

Skills and Requirements – add details here