Remote Cybersecurity Engineer: App Whitelisting & Defender

System One, Inc.; Merrifield (VA); Hybrid; USD 96,000 - 152,000; Full time

Job summary

System One, Inc. is seeking a Cybersecurity Engineer for a long-term contract. Remote or hybrid options are available in Vienna, VA, Winchester, VA, or Pensacola, FL. Ideal candidates have 8–10 years of professional experience in enterprise security.

The role emphasizes hands-on application whitelisting and Defender security solutions, including WDAC/App Control, AppLocker, ThreatLocker, or Airlock Digital, along with KQL-based investigations and policy management via Intune and MECM/SCCM.

Qualifications

• 8–10 years of professional cybersecurity experience.
• Hands-on WDAC/App Control, AppLocker, ThreatLocker, or Airlock Digital experience.
• Strong Microsoft Defender for Endpoint and Defender Antivirus knowledge.
• Experience with KQL-based investigations and Defender Advanced Hunting.
• Policy management through Intune and MECM/SCCM; scripting/automation experience.

Responsibilities

• Design, implement, tune, and troubleshoot application whitelisting policies across enterprise environments.
• Troubleshoot policy blocks using endpoint telemetry and Windows event logs.
• Manage Microsoft Defender for Endpoint and Defender Antivirus operations and remediation.
• Investigate security alerts, endpoint health, and telemetry issues.
• Collaborate with application owners and engineering teams to implement remediation paths.
• Develop runbooks, troubleshooting guides, and documentation.

Skills

WDAC/App Control

AppLocker

ThreatLocker

Airlock Digital

KQL

Intune

MECM/SCCM

PowerShell

Automation scripting

Tools

Microsoft Defender for Endpoint

Defender Antivirus

GitHub

MECM/SCCM

Airlock Digital

Job description

System One, Inc. is seeking a Cybersecurity Engineer for a long-term contract. Remote or hybrid options are available in Vienna, VA, Winchester, VA, or Pensacola, FL. Ideal candidates have 8–10 years of professional experience in enterprise security.

The role emphasizes hands-on application whitelisting and Defender security solutions, including WDAC/App Control, AppLocker, ThreatLocker, or Airlock Digital, along with KQL-based investigations and policy management via Intune and MECM/SCCM.