Cyber Security Engineer

BRMi•, TX

2d•$120,000 - $159,000•Remote

About The Position

We are seeking an experienced Cybersecurity Engineer to support enterprise application whitelisting, application control, and daily endpoint security operations. The role focuses on designing, implementing, maintaining, and troubleshooting application control policies while ensuring endpoint protection, security compliance, and operational stability across enterprise environments. The Cybersecurity Engineer will work extensively with Microsoft Defender for Endpoint, Defender Antivirus, Microsoft WDAC/App Control for Business, AppLocker, and other enterprise application control technologies. The position will also support the evaluation and testing of emerging security solutions, including ThreatLocker and Airlock Digital. The role supports endpoint security across Windows, macOS, and Linux environments, including workstations, servers, and virtual desktop infrastructure. It involves security investigations, troubleshooting, automation, policy testing and rollout, documentation, and collaboration with application owners, infrastructure teams, platform engineering, and cybersecurity stakeholders to implement effective controls while minimizing operational disruption. This is a W2 opportunity only. BRMi will not sponsor applicants for work visas. The role can be 100% remote in Texas, Virginia, Maryland, the District of Columbia, or Florida. High-profile roles may require candidates to fly to customer headquarters for an in-person interview; expenses are paid.

Requirements

Demonstrated experience in cybersecurity engineering, endpoint security administration, or a related information security discipline.
Strong hands-on experience with enterprise application whitelisting and application control technologies.
Experience implementing, configuring, and troubleshooting Microsoft WDAC/App Control for Business, AppLocker, or comparable application control platforms.
Strong experience administering and troubleshooting Microsoft Defender for Endpoint and Defender Antivirus.
Experience investigating endpoint security alerts, malware detections, endpoint health issues, and security policy enforcement failures.
Experience troubleshooting EDR technologies, including sensor health, telemetry, exclusions, scanning behavior, and performance-related issues.
Working knowledge of Microsoft Defender security capabilities, including attack surface reduction, Controlled Folder Access, tamper protection, and automated investigation and remediation.
Experience using KQL and Microsoft Defender Advanced Hunting for security investigations, troubleshooting, compliance analysis, and threat hunting.
Experience managing and deploying endpoint security policies through Microsoft Intune and MECM/SCCM.
Working knowledge of Windows, macOS, and Linux operating systems, including RHEL.
Understanding of application trust models, code signing, digital certificates, trusted publishers, file hashes, and path-based application control rules.
Experience analyzing Windows event logs, application control events, and endpoint telemetry to identify and resolve security issues.
Experience supporting endpoint security across workstations, servers, and virtual desktop infrastructure environments.
Strong understanding of cybersecurity principles, including malware prevention, vulnerability management, least privilege, defense-in-depth, threat detection, and security control validation.
Experience testing, validating, and troubleshooting security policies before enterprise deployment.
Ability to support phased deployments, assess operational impacts, and develop rollback procedures.
Experience using GitHub or similar source-control platforms to manage scripts, security policies, documentation, and configuration changes.
Strong analytical, troubleshooting, critical-thinking, and root-cause analysis skills.
Ability to distinguish legitimate application behavior from suspicious or malicious endpoint activity.
Experience developing technical documentation, operational runbooks, troubleshooting guides, and change management records.
Strong written and verbal communication skills.
Ability to collaborate effectively with application owners, infrastructure teams, platform engineers, and cybersecurity stakeholders.

Nice To Haves

Experience with ThreatLocker or Airlock Digital application control technologies.
Experience developing automation solutions using PowerShell, Ansible, or comparable scripting technologies.
Experience supporting application control proof-of-concept initiatives, enterprise security deployments, or endpoint security modernization efforts.

Responsibilities

Design, implement, maintain, tune, and troubleshoot enterprise application whitelisting and application control policies.
Administer and support Microsoft WDAC/App Control for Business, AppLocker, and comparable enterprise application control platforms.
Support proof-of-concept evaluations and testing of application control solutions, including ThreatLocker and Airlock Digital.
Investigate and resolve application execution blocks using endpoint telemetry, Windows event logs, application control events, and diagnostic tools.
Administer and support Microsoft Defender for Endpoint and Defender Antivirus across enterprise environments.
Monitor endpoint health, security compliance, protection status, and policy enforcement.
Investigate and remediate endpoint security alerts, malware detections, sensor issues, telemetry gaps, and protection-status discrepancies.
Troubleshoot Defender Antivirus and EDR issues involving performance, policy conflicts, exclusions, scanning behavior, and endpoint configuration.
Configure, maintain, and troubleshoot endpoint security capabilities, including attack surface reduction, Controlled Folder Access, tamper protection, and automated investigation and remediation.
Use Kusto Query Language (KQL) and Microsoft Defender Advanced Hunting to investigate endpoint activity, analyze security events, and validate security controls.
Manage endpoint security policy deployment, targeting, testing, validation, and troubleshooting through Microsoft Intune and MECM/SCCM.
Support endpoint security operations across Windows, macOS, and Linux systems, including Red Hat Enterprise Linux (RHEL).
Evaluate application trust requirements involving code signing, certificates, trusted publishers, file hashes, and application paths.
Maintain application control policies, scripts, documentation, and configuration history using GitHub or comparable source-control platforms.
Develop and maintain PowerShell, Ansible, and other automation scripts to improve endpoint security operations and policy management.
Support application control and endpoint security across workstations, servers, and virtual desktop infrastructure environments.
Analyze endpoint telemetry and security events to distinguish malicious or suspicious activity from legitimate application and system behavior.
Test and validate application control policies to identify potential compatibility issues and operational impacts.
Support phased security policy deployments, production rollout readiness, and rollback planning.
Document testing outcomes, including expected and actual results, identified issues, and recommended corrective actions.
Collaborate with application owners, platform engineering, infrastructure, and cybersecurity teams to investigate security issues and develop practical remediation solutions.
Develop and maintain operational runbooks, troubleshooting procedures, root-cause analysis documentation, change records, and audit evidence.
Support continuous improvement of endpoint security controls, operational processes, and application control standards.
Perform other duties as assigned.