Job description
Position Overview
MetroSys is seeking an experienced BeyondTrust Endpoint Privilege Management (EPM) Consultant to provide ad hoc professional services supporting a client experiencing application connectivity issues involving BeyondTrust EPM and Resideo/Honeywell Compass software.
The client currently has approximately 110 BeyondTrust EPM Desktop Cloud licenses for Windows and macOS endpoints. BeyondTrust has been implemented and was operating successfully; however, certain Windows workstations running Compass are now unable to connect to remote alarm panels despite being governed by the same BeyondTrust policies.
The consultant will be responsible for performing a cross-platform technical assessment to determine whether the issue originates from BeyondTrust EPM policies, Windows/Microsoft components, SQL/.NET dependencies, endpoint security controls, network behavior, or the Compass application itself.
This is not intended to be a traditional break/fix support role. The consultant should be capable of owning the investigation across multiple technologies, isolating the root cause, implementing or recommending remediation, and documenting appropriate BeyondTrust configuration and application-management practices.
Key Responsibilities
Review the client's existing BeyondTrust EPM Desktop Cloud configuration, policies, application rules, elevation policies, and endpoint behavior.
Troubleshoot Compass installation and runtime behavior across affected and functioning Windows endpoints.
Compare a known-working workstation against affected systems to identify differences in configuration, policy enforcement, permissions, services, registry settings, networking, and application dependencies.
Investigate whether BeyondTrust policies or endpoint controls are affecting or redirecting Compass communications with remote alarm panels.
Review application dependencies including Microsoft .NET Framework, SQL Server Express, Windows services, application permissions, and local security settings.
Analyze Compass outbound communications and determine whether connections are being blocked, redirected, modified, or otherwise affected by endpoint or network controls.
Review BeyondTrust application events, audit information, policy matches, elevation activity, and other available logs to identify potential conflicts.
Temporarily test or modify BeyondTrust policies in a controlled manner to isolate EPM as a potential cause without unnecessarily weakening endpoint security.
Coordinate troubleshooting findings with BeyondTrust, Resideo/Honeywell, Microsoft, and the client's internal IT team as appropriate.
Identify the root cause or provide a documented technical assessment identifying the most likely responsible component and recommended next steps.
Implement approved BeyondTrust configuration changes or application exceptions when required.
Document final configuration, troubleshooting findings, remediation steps, and recommended BeyondTrust EPM best practices.
Provide additional BeyondTrust professional services using a block-of-hours model as requested by the client.
Required Qualifications
Strong hands-on experience with BeyondTrust Endpoint Privilege Management (EPM) Cloud for Windows.
Experience creating, troubleshooting, and modifying BeyondTrust application control and privilege-management policies.
Strong Windows endpoint troubleshooting experience.
Working knowledge of Windows networking, application communications, DNS, firewall behavior, services, registry, and security controls.
Experience troubleshooting Windows applications dependent upon .NET Framework and Microsoft SQL Server/SQL Express.
Ability to analyze application behavior using Windows and network diagnostic tools.
Experience troubleshooting situations involving multiple vendors where the source of the issue is initially unknown.
Ability to independently perform discovery, testing, root-cause analysis, remediation, and technical documentation.
Strong client-facing communication skills and ability to coordinate with third-party vendor support teams.
Preferred Qualifications
BeyondTrust certifications or significant BeyondTrust EPM implementation experience.
Experience with Resideo/Honeywell Compass, alarm-management software, building automation, or similar Windows-based operational applications.
Experience with Microsoft Intune, Entra ID, Defender, Group Policy, or other endpoint-management/security platforms.
Experience troubleshooting application traffic using tools such as Wireshark, ProcMon, Event Viewer, PowerShell, or similar diagnostic utilities.
Originally posted on Himalayas
Who can apply
Eligible countries: United States. Accepted UTC offsets: UTC-10, UTC-9, UTC-8, UTC-7, UTC-6, UTC-5, UTC+14. Review the full description for employer-specific work authorization, residency and schedule requirements.