Description:
BIS-EE is seeking an Endpoint Security Engineer to assist in improving our endpoint cyber hygiene and vulnerability management program in collaboration with the CSPO.
Scope
This engagement requires a contract for a position for 1 year at 40 hours per week. The Endpoint Security Engineer will work closely with BIS-EE and CSPO.
Objectives
The ideal candidate will work with and support the projects and tasks associated with endpoint security and endpoint vulnerability management.
Experience
- Level III-Works independently with periodic review of work by a higher classification staff member. Has five or more years of relevant experience.
- Level IV-Performs investigation and analysis of business requirements; establishes requirements and objectives of solution; prepares detailed project plans; recommends methodologies necessary to accomplish plan. Consults with application managers on planning and monitoring of work. Has five or more years of relevant experience as a senior systems analyst or higher technical classification.
Tasks and Delivery
The Endpoint Security Engineer (contractor) will be embedded within the endpoint engineering team (3 Windows engineers, 2 macOS engineers) to enhance security operations and strengthen the security posture of client workstations. Typical responsibilities include:
Vulnerability Management & Analysis
- Identify, analyze, and prioritize endpoint vulnerabilities using tools such as Tenable, Axonius, Jamf Pro, SCCM, Intune, Active Directory, and Entra.
- Assess environmental and operational factors that may impact remediation feasibility and timelines.
- Provide risk-based recommendations to improve the vulnerability management program.
- Endpoint Remediation, Automation & Documentation
- Develop, test, and deploy remediation scripts and configurations for Windows and macOS endpoints using tools such as Jamf, ConfigMgr/SCCM, Intune, and Group Policy.
- Write clear, maintainable scripts and automation (e.g., modular logic, meaningful naming, basic error handling and logging) that can be reused by the team.
- Document scripts and configurations with purpose, parameters, usage instructions, and any security considerations to support troubleshooting and cross-team adoption.
- Maintain an organized library of remediation artifacts; if applicable, help establish and use a version-controlled repository (e.g., Git) to track changes and support basic peer review.
Baseline Configuration & Compliance
- Contribute to secure baseline configurations aligned with ClientCSPP, NIST 800-53 Rev 5, CIS Benchmarks, Microsoft Security Baselines, DISA STIGs, and/or macOS Security Compliance Project.
- Assist in the development, testing, implementation, and documentation of baseline configurations.
- Monitor baseline implementation for coverage, effectiveness, unapproved deviations, and required changes.
Collaboration & Reporting
- Participate in regular team meetings to provide status updates, propose improvements, and discuss implementation strategies.
- Monitor endpoint compliance and provide reports on remediation effectiveness and baseline configurations to leadership and stakeholders.
Required Knowledge, Skills, and Abilities
- Level 3 or 4 candidate from Appendix C.
- The ideal candidate will bring endpoint engineering expertise, strong cybersecurity skills, and modern, secure coding practices with 3 5 years of experience in complex large enterprise environments.
Endpoint Management
- Hands-on expertise with SCCM, Jamf Pro, and/or Microsoft Intune for Windows and macOS endpoints.
- Experience in packaging and deploying applications, security updates, and scripts across enterprise platforms.
- Familiarity with Group Policy and Intune for configuration management.
Secure Coding & SDLC Practices
- Proficiency in automation scripting (PowerShell, Bash, Python) with emphasis on modular, reusable, and secure code.
- Strong grasp of SDLC principles: requirements gathering, design, implementation, testing, deployment, and maintenance.
- Experience with version control systems (Git) and collaborative development workflows (branching, pull requests, peer review).
- Ability to document code and remediations clearly for cross-team adoption and knowledge transfer.
Security Frameworks & Compliance
- Knowledge of CVE program, NIST Vulnerability Database, CISA Known Exploited Vulnerability Database, and overall vulnerability management processes.
- Experience implementing NIST 800-53 Rev 5, CIS Benchmarks, DISA STIGs, Microsoft Security Baselines, and macOS Security Compliance Project.
- Ability to translate technical fixes into measurable improvements in endpoint security posture.
- Experience using Tenable.SC or Tenable.VM as part of vulnerability management.
Soft Skills
- Strong problem-solving skills with a focus on reducing organizational risk.
- Effective communication skills to convey technical concepts to both technical and non-technical stakeholders.
- Collaborative mindset for working within a mixed Windows/macOS engineering team
Work Schedule
Work schedule is normal business hours 8:30 am 5:00 pm CST, Monday through Friday. Work outside of these hours is not required or anticipated. Contract should be for one year (2080 hours), extended as needed.
Technical Direction of Work
The position will work under the BIS Infrastructure Endpoint Engineering manager.
Security Requirements
- These requirements may include, but are not limited to, such items as:
- Special pass or identification requirements
- Special security clearance requirements
- Special escort requirements
- Access to Client Business Information Systems
- Access to data requiring NDA or NDA-like terms
Never miss an opportunity! Create an alert based on the job you applied for.
