The objectives of this effort are:
Establish and maintain secure, standardized workstation images for macOS and Windows that support both on-site and remote access, including VDI connectivity.
Implement and maintain endpoint configuration baselines, patching, and version control using approved enterprise tools to reduce configuration drift and security risk.
Strengthen device registration, enrollment, and asset inventory accuracy to ensure visibility into users, devices, and access across the environment.
Enhance logging, telemetry, and monitoring capabilities to support detection, investigation, and response to suspicious or unauthorized activity on endpoints and networks.
Reduce the likelihood and impact of lateral movement and credential misuse through hardened configurations, secure authentication mechanisms, and consistent enforcement of baseline controls.
The Consultant shall provide engineering support by designing and maintaining technical controls, implementing approved configurations, and producing documentation and operational playbooks necessary to support IRM&TS operations, Service Desk engineering escalations, and the incident response function.
Knowledge Transfer, Documentation, and Runbooks
The Engineer shall make solutions operationally sustainable by the Service Desk and IRM teams. Responsibilities:
Produce user-facing runbooks for imaging/recovery, patch-validation steps, enrollment troubleshooting, and common remediation tasks that the Service Desk can safely execute.
Conduct periodic training and working sessions with Service Desk leads, IAM, and SOC staff to review new baselines, automation, and outage recovery steps.
Maintain a living knowledge-base with versioned documentation and clear escalation paths for image/patch/enrollment failures.
Exclusions and Boundaries
The Engineer shall not provide routine Tier 1 help desk ticket handling or general end- user desktop support unrelated to imaging, baseline remediation, enrollment, patching, or telemetry engineering.
The Engineer shall not be the final authority for security policy decisions; technical implementations will be coordinated with and approved by the COR, Cybersecurity leadership, and the CO as required.
Engineering Tooling and Software Procurement Support
The Consultant may identify the need for software, licenses, tools, or subscriptions required to perform the engineering tasks defined in this Description of Work (e.g., imaging tools, automation modules, logging agents, or endpoint management extensions).
The Consultant shall not independently procure items or spend government funds without prior written CO approval.
The Consultant may submit written recommendations and justifications to the COR identifying required tools, licensing models, estimated costs, and implementation impact.
Upon approval, the Consultant may assist with implementation, configuration, and validation of approved tools.
The Consultant shall provide personnel with demonstrated engineering expertise appropriate to the tools and responsibilities in this Description of Work and who meet the requirements of this Section 1.3.
1.3.1 Core Engineering Experience (Required for All Roles)
Eight (8) years of experience in Information Technology, Endpoint Engineering, or Cybersecurity.
Six (6) years of experience performing engineering (not help desk) functions in enterprise environments.
Experience working under formal change control, audit, and security governance processes.
1.3.2 Endpoint Imaging and Automation Engineering Applies to Sections 1.2.1 and 1.2.3.
Experience building and maintaining Windows and macOS workstation images.
Experience with image automation, validation, rollback, and version control.
Experience integrating images with VDI, EDR, authentication, and logging agents.
1.3.3 Patch and Configuration Management Engineering (Ivanti / KACE) Applies to Sections 1.2.1, 1.2.2, and 1.2.3.
Hands-on experience using Ivanti and/or KACE for OS and application patching.
Experience managing configuration drift, remediation workflows, and reporting.
Experience validating patches post-deployment and supporting rollback.
1.3.4 Device Enrollment and Identity Engineering (Intune / Autopilot / JAMF) Applies to Sections 1.2.1, 1.2.2, and 1.2.4.
Experience with Microsoft Intune and Windows Autopilot for provisioning and compliance enforcement.
Experience using JAMF Pro for macOS endpoint management (macOS only; not iOS unless directed).
Experience implementing passwordless authentication and hardware-backed credentials (YubiKey, CAC, software keys).
1.3.5 Logging, Monitoring, and Telemetry Engineering Applies to Sections 1.2.5 and 1.2.6.
Experience configuring endpoint logging (Windows Event Logs, macOS Unified Logs).
Experience forwarding and validating logs into SIEM/EDR platforms such as MS Sentinel (not limited).
Experience supporting forensic collection and audit readiness.
Preferred Education:
Bachelor's degree in Information Technology, Cybersecurity, or a related field (or equivalent experience).
Education Substitution:
Formal education requirements may be waived based on relevant professional experience, as determined by the COR.
Required Credentials
The consultant(s) provided by the Consultant must have the following current credentials:
Top Secret (TS) security clearance
Never miss an opportunity! Create an alert based on the job you applied for.