Endpoint Security Administration – Senior/SME

Job description

Minimum Requirements:

• Active DoD Secret Clearance (Required)

• Must be qualified under the DoD 8140 Cyber Workforce Qualification Program with the following:

• IT 521 – Endpoint Security Administrator

• Cyber 212 – Cybersecurity Service Provider (Infrastructure Support)

• 7+ years of professional IT experience, including at least 3+ years specializing in endpoint cybersecurity

• Demonstrated experience with Trellix ePolicy Orchestrator (ePO), both on-premises and cloud-based

• Strong grasp of cybersecurity frameworks (NIST 800-53, RMF) and DoD compliance (STIGs, TASKORDs, CTOs)

• Endpoint Security Solutions (ESS) Administrator 202 certificate - Required

• HBSS Advanced 301 & 501 Highly recommended.

Key Responsibilities:

• Ensure personnel and practices comply with DoD 8140, Cyber Workforce Qualification Matrix, and associated training repositories

• Configure, deploy, and maintain Endpoint Security (ENS) components and associated policy management

• On-Access/On-Demand Scans

• Access Protection

• Exploit Prevention

• Threat Prevention

• Firewall and Web Control Options

• Manage Data Loss Prevention (DLP) and Application Whitelisting:

• Develop and maintain DLP rules and policies

• Establish enterprise baselines for application whitelisting (Windows and *NIX)

• Utilize tools and standards including pxGrid, APIs, SAML, Okta, ODBC

• Maintain, monitor, and enforce compliance with all endpoint products:

• MDER/EDR solutions

• STIG compliance

• TASKORDs and CTO implementation

• Build strong stakeholder relationships across business units within DeCA

• Collaborate on endpoint settings, troubleshooting, and policy coordination across areas of responsibility

• Participate in Incident Response as needed and resolve endpoint-related tickets within established SLAs

• Maintain and document endpoint posture and system configuration

• Manage and validate:

• Policy Auditor benchmarks

• Rogue System Detection across enterprise subnets

• Endpoint Management Agent settings and updates

• C2C and Quarantine policies to isolate and remediate non-compliant devices

• Analyze syslog and packet data, perform subnetting, and integrate systems across Microsoft and Linux platforms

• Generate and coordinate reports (CMRS, Device/System Tags, ad hoc, compliance tracking)

Preferred Skills & Tools:

• McAfee/Trellix ePO, ENS, DLP, Rogue System Detection

• Scripting: PowerShell, Bash, Python

• Intermediate-level systems administration for Microsoft and Linux

• Familiarity with DoD and Agency cybersecurity directives and change control processes

• Ability to coordinate with 3rd-party providers and internal technical teams