INTERNAL CYBER DEFENSE ENGINEER

ADP, Inc.; Orlando (FL); On-site; USD 90,000 - 130,000; Full time

Job summary

ThreatLocker in Orlando, FL is seeking an Internal Cyber Defense Engineer to protect our endpoints, identities, and infrastructure from evolving cybersecurity threats. This hands-on role centers on security operations, threat detection, incident response, and contributes to governance, risk, and compliance initiatives.

The ideal candidate has practical experience with security alerts, security controls, and enterprise incident handling, collaborating with IT, MDR, and Threat Intelligence teams

Qualifications

• 3+ years in cybersecurity operations, SOC analysis, incident response, or internal security engineering.
• Active CompTIA Security+ certification.
• Active CompTIA Network+ certification.
• Experience with identity and access management security (MFA, conditional access, access reviews).
• Experience using SIEM to investigate events and tune rules.

Responsibilities

• Monitor, investigate, and respond to threats and alerts affecting internal systems.
• Support identity and access management security including MFA and conditional access.
• Investigate SIEM alerts and tune detection rules for improved monitoring.
• Administer endpoint security technologies (EDR/MDM/DLP) and collaborate with teams.
• Assist with incident response, threat analysis, containment, and remediation.

Skills

Cybersecurity operations

SOC analysis

Incident response

Identity security

Threat detection

Education

Bachelor's degree in Cybersecurity or related field

Tools

SIEM platforms

EDR

MDM

DLP

PowerShell

Job description

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

INTERNAL CYBER DEFENSE ENGINEER

PRODUCT Full Time Orlando, FL, US

2 days ago Requisition ID: 1065

COMPANY OVERVIEW

ThreatLocker® is a global cybersecurity leader that stops cyberattacks before they happen. The company's Zero Trust Platform prevents breaches from both known and unknown threats by allowing only explicitly trusted software and activity across endpoints, networks, and cloud systems. Built to deploy quickly and scale across complex environments, the platform reduces operational overhead while keeping business running uninterrupted. Headquartered in Orlando, Florida, with offices in EMEA, Dubai, and Brisbane, ThreatLocker protects over 70,000 organizations worldwide.

POSITION OVERVIEW

As an Internal Cyber Defense Engineer, you will help protect ThreatLocker's users, identities, systems, and internal infrastructure from evolving cybersecurity threats.

This is a hands-on position focused on security operations, identity security, threat detection, and incident response, with additional responsibilities supporting governance, risk, and compliance (GRC) initiatives.

The ideal candidate has practical experience investigating security alerts, administering security controls, and responding to cybersecurity incidents within an enterprise environment. You will collaborate with internal IT, Managed Detection and Response (MDR), and Threat Intelligence teams to identify risks, strengthen security controls, and improve the organization's overall security posture.

KEY RESPONSIBILITIES

• Monitor, investigate, and respond to cybersecurity threats and security alerts affecting ThreatLocker's internal systems and infrastructure.
• Support identity and access management security, including multifactor authentication (MFA), conditional access, privileged access, and access reviews.
• Monitor and investigate SIEM alerts, assist with tuning detection rules, and identify opportunities to improve security monitoring.
• Support the administration and monitoring of endpoint, device, and data protection technologies, including EDR, MDM, and DLP.
• Collaborate with internal MDR and Threat Intelligence teams to investigate incidents, identify emerging threats, and implement appropriate security measures.
• Assist with incident response activities, including threat analysis, containment, remediation, and documentation.
• Coordinate phishing simulations and security awareness initiatives to help educate employees and reduce organizational risk.
• Support governance, risk, and compliance (GRC) activities, including security policies, risk assessments, control documentation, and audit preparation.
• Maintain security documentation, incident response procedures, and reports on security incidents, detection performance, and compliance activities.
• Work collaboratively with IT and other internal teams to identify vulnerabilities, strengthen security controls, and continuously improve ThreatLocker's security posture.

REQUIRED QUALIFICATIONS

• 3+ years of professional experience in cybersecurity operations, SOC analysis, incident response, or internal security engineering.
• Active CompTIA Security+ certification.
• Active CompTIA Network+ certification.
• Hands-on experience administering or securing enterprise identity and access management systems, including MFA, conditional access policies, and access controls.
• Practical experience using SIEM platforms to investigate security events, analyze logs, execute queries, and identify potential threats.
• Experience administering, monitoring, or investigating threats using enterprise endpoint security solutions, including EDR technologies.
• Experience securing or investigating security incidents within Windows and Microsoft 365 enterprise environments.
• Demonstrated ability to analyze network traffic, investigate suspicious activity, and troubleshoot security-related networking issues.
• Experience documenting security investigations, communicating findings, and coordinating remediation with technical teams.
• Strong analytical, problem-solving, and communication skills, with the ability to prioritize and respond to security incidents in a fast-paced environment.

PREFERRED QUALIFICATIONS

• Additional cybersecurity certifications such as CompTIA CySA+, CISSP, GIAC (GSEC, GCIH, GCIA), CISA, CISM, or CRISC.
• Experience using PowerShell, Python, or similar scripting languages for security administration, investigation, or automation.
• Experience developing or tuning SIEM queries, correlation rules, dashboards, and security detections.
• Experience with mobile device management (MDM), data loss prevention (DLP), or identity threat detection technologies.
• Experience supporting threat intelligence workflows, threat hunting, detection engineering, or Zero Trust security initiatives.
• Experience supporting governance, risk, and compliance (GRC) initiatives, including security policy development, risk assessments, control mapping, and audit preparation.
• Experience supporting SOC 2, ISO 27001, or similar security and compliance audits.
• Experience with third-party risk management or GRC automation tools.
• Experience administering phishing simulation or security awareness training platforms.
• Experience developing security dashboards or reporting using SIEM platforms, Power BI, or similar tools.
• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field, or equivalent practical experience.

WORKING CONDITIONS

The duties described are representative of those encountered while performing the essential functions of this position. Reasonable accommodation may be requested and will be evaluated for its relationship to those functions.

• Work is generally performed in an on-site office environment in Orlando, Florida, and may require occasional travel to company locations.
• This role may require participation in an on-call rotation or after-hours incident response.
• The employee will occasionally stand, walk, sit, reach, stoop or kneel, talk and hear, and use hands and fingers to operate a computer and other equipment.
• Must occasionally lift and/or move up to 25 pounds.
• Specific vision abilities include close vision, distance vision, depth perception, and the ability to adjust focus.

A background check and drug/substance screening are required after a conditional offer. Employment will proceed only upon receiving clear results from both.

ThreatLocker also conducts randomized drug and substance testing approximately every 60 days, in line with the same screening standards.