Job Description – CylancePROTECT SME

Position Title: CylancePROTECT Subject Matter Expert (SME)

Experience: 8–10 Years

Role Summary:

The CylancePROTECT SME will be responsible for the deployment, configuration, administration, and operational management of the Cylance endpoint security platform. The role includes onboarding and securing endpoints, managing policies, supporting security incidents, performing platform maintenance, and ensuring continuous protection through effective BAU operations.

The ideal candidate should possess strong expertise in endpoint security technologies, threat prevention, endpoint management, and enterprise security operations.

Key Responsibilities

Deployment & Implementation

• Lead enterprise-wide deployment of CylancePROTECT across OT/ICS environments.
• Plan and execute agent rollouts for Engineering workstations, servers, OT endpoints.
• Integrate Cylance with endpoint management platforms such as Microsoft Intune, SCCM.
• Support migration from legacy antivirus and endpoint security platforms.
• Develop deployment plans, implementation procedures, and operational runbooks.
• Coordinate with infrastructure, endpoint, network, and security teams during implementation activities.

Platform Configuration & Administration

• Configure and maintain CylancePROTECT policies and security settings.
• Manage threat prevention, memory protection, script control, device control, and quarantine policies.
• Create and maintain allowlists, exclusions, and exception requests.
• Perform policy tuning to optimize protection levels while minimizing false positives.
• Manage user roles, permissions, and RBAC administration.
• Ensure endpoint compliance and policy consistency across the environment.

BAU Operations & Platform Management

• Monitor platform health, endpoint connectivity, and agent status.
• Manage agent upgrades, software updates, and version lifecycle activities.
• Conduct routine health checks and operational maintenance.
• Ensure endpoint protection coverage and compliance across managed assets.
• Generate operational reports, dashboards, and service metrics.
• Maintain licensing, asset inventory, and platform documentation.
• Participate in change management and maintenance activities.

Incident Response & Operational Support

• Investigate malware detections, security alerts, and endpoint-related incidents.
• Support SOC and incident response teams during security investigations.
• Perform malware containment, remediation, and recovery activities.
• Analyse threats and provide recommendations for risk reduction.
• Conduct root cause analysis and support post-incident reviews.
• Escalate and coordinate complex issues with vendor support teams.

Troubleshooting & Problem Management

• Troubleshoot agent deployment, communication, and policy application issues.
• Resolve endpoint performance and compatibility concerns.
• Review platform logs and diagnostics to identify root causes.
• Manage false positive investigations and policy optimizations.
• Maintain knowledge articles and troubleshooting documentation.

Reporting, Compliance & Governance

• Produce regular reports on endpoint coverage, detections, compliance, and platform health.
• Support internal audits and regulatory compliance initiatives.
• Ensure adherence to enterprise security standards and operational procedures.
• Maintain accurate operational and technical documentation.

Technical Skills

• Strong hands-on experience administering CylancePROTECT in OT environments.
• Experience with endpoint security, antivirus, EPP, EDR/XDR technologies.
• Experience with Microsoft Intune, SCCM, and Active Directory.
• Understanding of malware analysis, threat remediation, and security operations.
• Familiarity with PowerShell scripting and automation.
• Experience with ITSM tools such as ServiceNow.

Operational Skills

• Endpoint onboarding and lifecycle management.
• Security policy management and tuning.
• Incident investigation and remediation.
• Change, release, and problem management.
• Reporting, compliance, and documentation management.

Preferred Qualifications

• Bachelor’s degree in information security, Computer Science, or related field.
• Industry certifications such as: 
• CISSP
• Security+
• CEH
• Microsoft Security Certifications
• BlackBerry Cylance Certifications (preferred)

Key Deliverables

• Successful deployment and onboarding of endpoints.
• Effective management of Cylance security policies and configurations.
• Continuous monitoring and maintenance of platform health.
• Timely response and remediation of security incidents.
• Compliance reporting and audit support.
• Continuous improvement of endpoint security posture through proactive BAU operations.

Role Level: L2 / L3 Security Engineer or SME
Primary Technology: CylancePROTECT
Support Model: Business Hours / 24x7 On-Call Support as required.