Engineering for IT Environment/Service Desk (SMA3)

Job Title: Service Desk Analyst
Location: Washington DC
Job Description:
CBO requires IT Engineering Support Services to design, implement, and maintain technical
controls to reduce the risk of unauthorized initial discovery and lateral movement, malicious
credential use and defense evasion, and persistence via machine key and related system-abuse
techniques within CBO s environment. The engineering services will also enable secure
endpoint, identity, and device lifecycle operations in support of CBO s threat detection and
mitigation strategy. This scope does not include routine end-user help desk support, but rather
engineering tasks to resolve issues arising from complex or escalated tickets.
The objectives of this effort are:
Establish and maintain secure, standardized workstation images for macOS and Windows
that support both on-site and remote access, including VDI connectivity.
Implement and maintain endpoint configuration baselines, patching, and version control
using approved enterprise tools to reduce configuration drift and security risk.
Strengthen device registration, enrollment, and asset inventory accuracy to ensure
visibility into users, devices, and access across the environment.
Enhance logging, telemetry, and monitoring capabilities to support detection,
investigation, and response to suspicious or unauthorized activity on endpoints and
networks.
Reduce the likelihood and impact of lateral movement and credential misuse through
hardened configurations, secure authentication mechanisms, and consistent enforcement
of baseline controls.
The Contractor shall provide engineering support by designing and maintaining technical
controls, implementing approved configurations, and producing documentation and operational
playbooks necessary to support IRM&TS operations, Service Desk engineering escalations, and
the incident response function.

Scope of Work
This document refers to Engineer singularly, but it is expected that the Contractor will provide
multiple personnel to fill the roles required by this scope of work. The Contractor employees will
be responsible for implementing new solutions and leveraging existing tools within the
architecture to support logging and auditing of security controls, as well as necessary upgrades
and feature enhancements. The team will also assist in administering all information security
functions for the Windows and macOS baselines, including updates, upgrades, policy
Attachment J7 CB26-RFQ0012
administration, and validation for special access to CBO s segmented environments (both cloud
and non-cloud).
The scope of work includes, but is not limited to, the following activities:
Assist CBO in building, maintaining, and securing existing standard workstation images
that enable access to the VDI environment for remote users on both macOS and Windows
platforms.
Assist CBO in building, maintaining, and securing existing standard workstation images
that enable access to the VDI environment for on-site users on both macOS and Windows
platforms.
Maintain operating system and application patching, version control, and lifecycle
management for supported applications. Ensure that new and updated applications are
delivered through approved mechanisms such as a company application store, Intune, or
Group Policy (GPO), as appropriate based on user role and access level.
Support Microsoft Intune registration and Windows Autopilot for desktops, laptops, and
CBO-issued mobile devices, including implementation of passwordless authentication,
hardware security keys (e.g., YubiKeys), and other protections for privileged and
sensitive accounts.
Implement and maintain logging, monitoring, and audit capabilities to track device
enrollment, user authentication activity, network access, and endpoint behavior to
determine which users and devices are connected to the network and what activity is
occurring.

The following roles are anticipated to be required for this work and are considered Key
Personnel, in accordance with SOW paragraph 2.9.
Engineer
Cloud Service Desk Rep
Apple/macOS SME
Microsoft SME

Eight (8) years of experience in Information Technology, Endpoint Engineering, or
Cybersecurity.
Six (6) years of experience performing engineering (not help desk) functions in
enterprise environments.
Experience working under formal change control, audit, and security governance
processes.