INTERNAL CYBER DEFENSE ENGINEER

SKY VC; Orlando (FL); On-site; USD 110,000 - 150,000; Full time

Job summary

ThreatLocker in Orlando, FL is seeking an Internal Cyber Defense Engineer to protect our users, identities and infrastructure from evolving threats. This hands-on role focuses on security operations, threat detection, incident response, and GRC support.

You will work with IT, MDR and Threat Intelligence teams to strengthen controls and improve our security posture. Candidates should have 3+ years of cybersecurity experience, SIEM; MFA and IAM experience; Windows/M365 security; and strong

Qualifications

• 3+ years in cybersecurity ops, SOC, IR or internal security engineering.
• Active Security+ and Network+ certifications.
• Hands-on IAM administration with MFA and access controls.
• Experience using SIEM to investigate events and queries.
• Experience with EDR and endpoint security in enterprise envs.
• Security in Windows/M365 enterprise environments.
• Ability to analyze network traffic and troubleshoot security issues.
• Experience documenting investigations and coordinating remediation.
• Strong analytical, problem-solving and communication skills.

Responsibilities

• Monitor, investigate and respond to threats and alerts for ThreatLocker systems.
• Support IAM security, MFA, conditional access, and access reviews.
• Tune SIEM detections and investigate alerts with MDR/Threat Intelligence.
• Administer endpoint protection technologies including EDR/MDM/DLP.
• Collaborate with MDR and Threat Intelligence to mitigate incidents.
• Assist with incident response including containment and remediation.
• Coordinate phishing simulations and security awareness initiatives.
• Support GRC activities: policies, risk assessments, audits.
• Maintain incident response docs and reports on security events.
• Work with IT and teams to identify vulnerabilities and improve controls.

Skills

Cybersecurity ops

Security+ certification

Network+ certification

IAM administration

SIEM usage

EDR security

Windows/M365 security

Network analysis

Security reporting

Communication skills

Education

Bachelor's degree in Cybersecurity/IT/CS

Tools

PowerShell

Python

Job description

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

INTERNAL CYBER DEFENSE ENGINEER

PRODUCT Full Time Orlando, FL, US

2 days ago Requisition ID: 1065

COMPANY OVERVIEW

ThreatLocker® is a global cybersecurity leader that stops cyberattacks before they happen. The company's Zero Trust Platform prevents breaches from both known and unknown threats by allowing only explicitly trusted software and activity across endpoints, networks, and cloud systems. Built to deploy quickly and scale across complex environments, the platform reduces operational overhead while keeping business running uninterrupted. Headquartered in Orlando, Florida, with offices in EMEA, Dubai, and Brisbane, ThreatLocker protects over 70,000 organizations worldwide.

POSITION OVERVIEW

As an Internal Cyber Defense Engineer, you will help protect ThreatLocker's users, identities, systems, and internal infrastructure from evolving cybersecurity threats.

This is a hands-on position focused on security operations, identity security, threat detection, and incident response, with additional responsibilities supporting governance, risk, and compliance (GRC) initiatives.

The ideal candidate has practical experience investigating security alerts, administering security controls, and responding to cybersecurity incidents within an enterprise environment. You will collaborate with internal IT, Managed Detection and Response (MDR), and Threat Intelligence teams to identify risks, strengthen security controls, and improve the organization's overall security posture.

KEY RESPONSIBILITIES

• Monitor, investigate, and respond to cybersecurity threats and security alerts affecting ThreatLocker's internal systems and infrastructure.
• Support identity and access management security, including multifactor authentication (MFA), conditional access, privileged access, and access reviews.
• Monitor and investigate SIEM alerts, assist with tuning detection rules, and identify opportunities to improve security monitoring.
• Support the administration and monitoring of endpoint, device, and data protection technologies, including EDR, MDM, and DLP.
• Collaborate with internal MDR and Threat Intelligence teams to investigate incidents, identify emerging threats, and implement appropriate security measures.
• Assist with incident response activities, including threat analysis, containment, remediation, and documentation.
• Coordinate phishing simulations and security awareness initiatives to help educate employees and reduce organizational risk.
• Support governance, risk, and compliance (GRC) activities, including security policies, risk assessments, control documentation, and audit preparation.
• Maintain security documentation, incident response procedures, and reports on security incidents, detection performance, and compliance activities.
• Work collaboratively with IT and other internal teams to identify vulnerabilities, strengthen security controls, and continuously improve ThreatLocker's security posture.

REQUIRED QUALIFICATIONS

• 3+ years of professional experience in cybersecurity operations, SOC analysis, incident response, or internal security engineering.
• Active CompTIA Security+ certification.
• Active CompTIA Network+ certification.
• Hands-on experience administering or securing enterprise identity and access management systems, including MFA, conditional access policies, and access controls.
• Practical experience using SIEM platforms to investigate security events, analyze logs, execute queries, and identify potential threats.
• Experience administering, monitoring, or investigating threats using enterprise endpoint security solutions, including EDR technologies.
• Experience securing or investigating security incidents within Windows and Microsoft 365 enterprise environments.
• Demonstrated ability to analyze network traffic, investigate suspicious activity, and troubleshoot security-related networking issues.
• Experience documenting security investigations, communicating findings, and coordinating remediation with technical teams.
• Strong analytical, problem-solving, and communication skills, with the ability to prioritize and respond to security incidents in a fast-paced environment.

PREFERRED QUALIFICATIONS

• Additional cybersecurity certifications such as CompTIA CySA+, CISSP, GIAC (GSEC, GCIH, GCIA), CISA, CISM, or CRISC.
• Experience using PowerShell, Python, or similar scripting languages for security administration, investigation, or automation.
• Experience developing or tuning SIEM queries, correlation rules, dashboards, and security detections.
• Experience with mobile device management (MDM), data loss prevention (DLP), or identity threat detection technologies.
• Experience supporting threat intelligence workflows, threat hunting, detection engineering, or Zero Trust security initiatives.
• Experience supporting governance, risk, and compliance (GRC) initiatives, including security policy development, risk assessments, control mapping, and audit preparation.
• Experience supporting SOC 2, ISO 27001, or similar security and compliance audits.
• Experience with third-party risk management or GRC automation tools.
• Experience administering phishing simulation or security awareness training platforms.
• Experience developing security dashboards or reporting using SIEM platforms, Power BI, or similar tools.
• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field, or equivalent practical experience.

WORKING CONDITIONS

The duties described are representative of those encountered while performing the essential functions of this position. Reasonable accommodation may be requested and will be evaluated for its relationship to those functions.

• Work is generally performed in an on-site office environment in Orlando, Florida, and may require occasional travel to company locations.
• This role may require participation in an on-call rotation or after-hours incident response.
• The employee will occasionally stand, walk, sit, reach, stoop or kneel, talk and hear, and use hands and fingers to operate a computer and other equipment.
• Must occasionally lift and/or move up to 25 pounds.
• Specific vision abilities include close vision, distance vision, depth perception, and the ability to adjust focus.

A background check and drug/substance screening are required after a conditional offer. Employment will proceed only upon receiving clear results from both.

ThreatLocker also conducts randomized drug and substance testing approximately every 60 days, in line with the same screening standards.