Position Overview

MetroSys is seeking an experienced BeyondTrust Endpoint Privilege Management (EPM) Consultant to provide ad hoc professional services supporting a client experiencing application connectivity issues involving BeyondTrust EPM and Resideo/Honeywell Compass software.

The client currently has approximately 110 BeyondTrust EPM Desktop Cloud licenses for Windows and macOS endpoints. BeyondTrust has been implemented and was operating successfully; however, certain Windows workstations running Compass are now unable to connect to remote alarm panels despite being governed by the same BeyondTrust policies.

The consultant will be responsible for performing a cross-platform technical assessment to determine whether the issue originates from BeyondTrust EPM policies, Windows/Microsoft components, SQL/.NET dependencies, endpoint security controls, network behavior, or the Compass application itself.

This is not intended to be a traditional break/fix support role. The consultant should be capable of owning the investigation across multiple technologies, isolating the root cause, implementing or recommending remediation, and documenting appropriate BeyondTrust configuration and application-management practices.

Key Responsibilities

• Review the client's existing BeyondTrust EPM Desktop Cloud configuration, policies, application rules, elevation policies, and endpoint behavior.
• Troubleshoot Compass installation and runtime behavior across affected and functioning Windows endpoints.
• Compare a known-working workstation against affected systems to identify differences in configuration, policy enforcement, permissions, services, registry settings, networking, and application dependencies.
• Investigate whether BeyondTrust policies or endpoint controls are affecting or redirecting Compass communications with remote alarm panels.
• Review application dependencies including Microsoft .NET Framework, SQL Server Express, Windows services, application permissions, and local security settings.
• Analyze Compass outbound communications and determine whether connections are being blocked, redirected, modified, or otherwise affected by endpoint or network controls.
• Review BeyondTrust application events, audit information, policy matches, elevation activity, and other available logs to identify potential conflicts.
• Temporarily test or modify BeyondTrust policies in a controlled manner to isolate EPM as a potential cause without unnecessarily weakening endpoint security.
• Coordinate troubleshooting findings with BeyondTrust, Resideo/Honeywell, Microsoft, and the client's internal IT team as appropriate.
• Identify the root cause or provide a documented technical assessment identifying the most likely responsible component and recommended next steps.
• Implement approved BeyondTrust configuration changes or application exceptions when required.
• Document final configuration, troubleshooting findings, remediation steps, and recommended BeyondTrust EPM best practices.
• Provide additional BeyondTrust professional services using a block-of-hours model as requested by the client.

Required Qualifications

• Strong hands-on experience with BeyondTrust Endpoint Privilege Management (EPM) Cloud for Windows.
• Experience creating, troubleshooting, and modifying BeyondTrust application control and privilege-management policies.
• Strong Windows endpoint troubleshooting experience.
• Working knowledge of Windows networking, application communications, DNS, firewall behavior, services, registry, and security controls.
• Experience troubleshooting Windows applications dependent upon .NET Framework and Microsoft SQL Server/SQL Express.
• Ability to analyze application behavior using Windows and network diagnostic tools.
• Experience troubleshooting situations involving multiple vendors where the source of the issue is initially unknown.
• Ability to independently perform discovery, testing, root-cause analysis, remediation, and technical documentation.
• Strong client-facing communication skills and ability to coordinate with third-party vendor support teams.

Preferred Qualifications

• BeyondTrust certifications or significant BeyondTrust EPM implementation experience.
• Experience with Resideo/Honeywell Compass, alarm-management software, building automation, or similar Windows-based operational applications.
• Experience with Microsoft Intune, Entra ID, Defender, Group Policy, or other endpoint-management/security platforms.
• Experience troubleshooting application traffic using tools such as Wireshark, ProcMon, Event Viewer, PowerShell, or similar diagnostic utilities.