Senior Cyber Security Engineer – Application Whitelisting & End Point Security --- 100 % Remote ---- No Third Parties

Zillion Technologies is recruiting for a client whose identity is not specified. The Senior Cyber Security Engineer will support enterprise application control and day-to-day endpoint security operations, including policy implementation, troubleshooting, and deployment readiness.

Responsibilities:

• Design, implement, tune, and troubleshoot application whitelisting/application control policies across enterprise environments
• Troubleshoot application execution blocks using endpoint telemetry, Windows event logs, application control events, and other diagnostic data
• Experience supporting day-to-day Defender operations, including investigating security alerts, endpoint health issues, sensor/telemetry issues, malware detections, and protection-status discrepancies
• Experience troubleshooting Defender Antivirus and EDR behavior, including performance-related issues, policy conflicts, exclusions, scanning behavior, and endpoint onboarding or configuration issues
• Experience managing endpoint security policies through Microsoft Intune and MECM/SCCM, including deployment, targeting, testing, validation, and troubleshooting
• Ability to analyze security events and endpoint telemetry to distinguish malicious or suspicious activity from legitimate application and system behavior
• Ability to perform policy testing and validation, support phased deployments, document expected versus actual results, and assist with production rollout readiness and rollback planning
• Ability to develop and maintain runbooks, troubleshooting procedures, root-cause analysis documentation, operational checklists, change documentation, and audit evidence
• Strong communication and troubleshooting skills with the ability to work directly with application owners, platform engineering teams, infrastructure teams, and cybersecurity teams to investigate issues and develop practical remediation paths

Requirements:

• Applicants must be a United States citizen, Green card holder or EAD Green Cards at the direction of our client
• strong hands-on experience with Microsoft WDAC/App Control for Business, AppLocker, or other enterprise application whitelisting/application control technologies
• Experience with WDAC/App Control for Business, AppLocker, ThreatLocker, Airlock Digital, or comparable application control platforms
• Strong experience with Microsoft Defender for Endpoint and Defender Antivirus, including endpoint health, compliance monitoring, policy troubleshooting, AV/EDR exclusions, and remediation
• Experience supporting day-to-day Defender operations, including investigating security alerts, endpoint health issues, sensor/telemetry issues, malware detections, and protection-status discrepancies
• Experience troubleshooting Defender Antivirus and EDR behavior, including performance-related issues, policy conflicts, exclusions, scanning behavior, and endpoint onboarding or configuration issues
• Working knowledge of Defender security capabilities such as attack surface reduction, Controlled Folder Access, tamper protection, automated investigation/remediation, and endpoint detection and response
• Experience with KQL and Microsoft Defender Advanced Hunting for endpoint investigation, troubleshooting, compliance analysis, threat hunting, and validation
• Experience managing endpoint security policies through Microsoft Intune and MECM/SCCM, including deployment, targeting, testing, validation, and troubleshooting
• Working knowledge across Windows, macOS, and Linux, particularly Red Hat Enterprise Linux (RHEL) environments
• Knowledge of code signing, certificates, trusted publishers/signers, hashes, paths, and application trust models
• Experience with GitHub or similar source-control platforms for maintaining application control policies, scripts, documentation, versioning, and change history
• Experience supporting application control and endpoint security across workstations, servers, and VDI environments
• Strong understanding of cybersecurity fundamentals, including endpoint security, malware prevention, vulnerability management, least privilege, defense-in-depth, threat detection, and security control validation
• Ability to analyze security events and endpoint telemetry to distinguish malicious or suspicious activity from legitimate application and system behavior
• Ability to perform policy testing and validation, support phased deployments, document expected versus actual results, and assist with production rollout readiness and rollback planning
• Ability to develop and maintain runbooks, troubleshooting procedures, root-cause analysis documentation, operational checklists, change documentation, and audit evidence
• Strong communication and troubleshooting skills with the ability to work directly with application owners, platform engineering teams, infrastructure teams, and cybersecurity teams to investigate issues and develop practical remediation paths
• Experience with ThreatLocker and/or Airlock Digital is highly desirable given upcoming proof-of-concept efforts
• Experience with Ansible, PowerShell, and other scripting or automation technologies is highly desirable