GES is seeking a Vulnerability Management and Endpoint Security Administrator to provide cybersecurity expertise supporting large-scale migration and operations on a high-profile Department of War (DoW) contract. The I3TS program provides enterprise-wide IT support to enable the Defense Threat Reduction Agency’s Information Management & Technology Directorate to consolidate, modernize, and continuously improve delivery of IT services and mission capabilities to internal and external mission partners operating in CONUS and OCONUS locations. The selected candidate will serve as a cybersecurity subject matter resource across the Vulnerability Management and Endpoint Security teams and will exercise independent judgment in analyzing cybersecurity risks, determining remediation priorities, evaluating technical solutions, and recommending courses of action affecting enterprise endpoints and infrastructure. The role requires strong technical expertise with ACAS/Nessus and Tanium, along with working knowledge of Trellix endpoint-security technologies. The candidate will independently evaluate complex vulnerability and endpoint-security issues, assess operational and mission impacts, and develop recommendations that balance cybersecurity requirements, technical feasibility, and operational objectives.
Primary Responsibilities:
- Independently analyze enterprise vulnerability and endpoint-security posture across Windows, Linux, virtual, and other enterprise environments and recommend technical and risk-based courses of action.
- Administer and optimize Assured Compliance Assessment Solution (ACAS)/Nessus vulnerability-management capabilities, including scan architecture, policies, credentialed scanning, analysis, reporting, and technical troubleshooting.
- Perform in-depth vulnerability and risk analysis; validate findings; assess technical, operational, and mission impacts; establish risk-based remediation priorities; and recommend remediation strategies to system owners and technical leadership.
- Exercise independent technical judgment in evaluating vulnerabilities, compensating controls, remediation alternatives, exceptions, and cybersecurity risks.
- Leverage Tanium capabilities to analyze endpoint visibility, asset inventory, compliance, vulnerability exposure, configuration posture, and remediation requirements across the enterprise.
- Analyze endpoint-security posture using Trellix and associated technologies; investigate security alerts, policy issues, configuration deficiencies, agent-health concerns, and other conditions requiring technical evaluation.
- Correlate vulnerability, endpoint, asset-inventory, compliance, and security-tool data to identify systemic security risks, coverage gaps, unmanaged assets, trends, and enterprise remediation priorities.
- Develop and recommend technical solutions for complex vulnerability-management and endpoint-security issues, considering cybersecurity risk, system dependencies, operational requirements, and mission impact.
- Evaluate vulnerability exceptions and risk-acceptance requests and provide technical risk assessments and recommendations to cybersecurity, technical, and program leadership.
- Analyze endpoint configurations and security baselines and recommend security-hardening strategies consistent with Security Technical Implementation Guides (STIGs), applicable security controls, and operational requirements.
- Develop vulnerability-management metrics, dashboards, risk analyses, trend reporting, and executive-level summaries that enable leadership to make informed cybersecurity and risk-management decisions.
- Provide cybersecurity expertise during incident-response, threat-hunting, and endpoint-containment activities and independently assess appropriate technical actions when vulnerabilities or malicious activity are identified.
- Evaluate proposed changes to endpoint architectures, configurations, software, security tooling, and infrastructure; determine cybersecurity and operational impacts; identify alternatives; and provide technical recommendations to leadership.
- Analyze and recommend improvements to vulnerability-management and endpoint-security processes, controls, technologies, and operating procedures to increase effectiveness, reduce cybersecurity risk, and improve enterprise security posture.
- Develop technical standards, procedures, methodologies, process documentation, and knowledge articles governing vulnerability-management and endpoint-security activities.
- Serve as a technical advisor to system owners, engineers, cybersecurity personnel, and program leadership regarding vulnerability-management and endpoint-security risks, priorities, and remediation strategies.
- Manage competing cybersecurity priorities and independently determine appropriate technical approaches within established program, contractual, and security requirements.
- Work effectively in a fast-paced environment requiring independent decision-making across short-, mid-, and long-term cybersecurity and remediation objectives.
Required Qualifications
- Bachelor’s degree and 4+ years of relevant cybersecurity, vulnerability management, endpoint security, systems administration, information assurance, or related technical experience; or 8+ years of relevant experience in lieu of a degree.
- 4+ years of progressively responsible experience performing vulnerability management, endpoint security, cybersecurity engineering, or information-assurance functions within an enterprise environment.
- Demonstrated ability to independently analyze complex cybersecurity vulnerabilities, assess technical and operational risk, evaluate alternative remediation strategies, and recommend appropriate courses of action.
- Strong hands-on expertise with ACAS/Nessus, including vulnerability scanning, scan-policy administration, credentialed-scan troubleshooting, vulnerability analysis, reporting, remediation strategy, and closure validation.
- Strong hands-on expertise with Tanium for endpoint visibility, asset inventory, endpoint management, compliance analysis, vulnerability remediation, and enterprise security assessment.
- Working knowledge of Trellix endpoint-security technologies, including the ability to assess endpoint-security posture, investigate alerts and policy issues, evaluate configurations, and recommend corrective actions.
- Experience conducting risk-based vulnerability analysis and developing remediation priorities based on vulnerability severity, threat information, system criticality, operational impact, and available compensating controls.
- Experience administering, securing, analyzing, or engineering Microsoft Windows and Linux endpoint environments.
- Working knowledge of STIG compliance, SCC, STIG Viewer, secure configuration baselines, security-hardening methodologies, and cybersecurity control implementation.
- Understanding of NIST, ICD, CNSS, and DoD information-assurance and cybersecurity standards and the ability to interpret and apply requirements to enterprise technical environments.
- Ability to evaluate complex technical information, identify cybersecurity implications, and communicate risk-based recommendations to technical and program leadership.
- Must meet DoD 8570.01-M Information Assurance Technical (IAT) Level II baseline certification requirements. Acceptable certifications include CompTIA Security+ CE or a higher-level certification satisfying the IAT Level II requirement. Must also meet applicable DoD 8140 Cyberspace Workforce Qualification Program requirements for assigned DoD Cyber Workforce Framework work role(s), as required by the contract and customer.
- Must possess and maintain an active Top Secret/Sensitive Compartmented Information (TS/SCI) clearance.
- Strong written, verbal, analytical, organizational, and problem-solving skills.
- Demonstrated ability to exercise independent judgment, manage competing priorities, develop technical recommendations, and work effectively within a cross-functional Vulnerability Management and Endpoint Security team.
Desired Qualifications
- Advanced Tanium expertise, including Tanium Asset, Discover, Comply, Deploy, Patch, Interact, Reporting, and/or custom question and sensor development.
- Advanced ACAS/Nessus expertise, including scanner architecture and deployment, scan-policy development and administration, credentialed-scan troubleshooting, dashboard development, large-scale remediation analysis and reporting, and Linux backend troubleshooting.
- Experience with Trellix ePolicy Orchestrator, Trellix Endpoint Security, Microsoft Defender for Endpoint, or comparable endpoint detection and response platforms.
- Past or current Information System Security Officer (ISSO), Information System Security Manager (ISSM), cybersecurity engineer, or comparable information-assurance experience.
- Experience supporting DoW networks, classified environments, or large-scale enterprise cybersecurity operations.
- Experience designing vulnerability-management dashboards, automated reporting solutions, or data integrations using PowerShell, Python, SQL, or similar scripting and automation technologies.
- Experience evaluating vulnerability exceptions, risk-acceptance requests, Plans of Action and Milestones (POA&Ms), compensating controls, and remediation-governance decisions.
- Experience advising technical or program leadership on cybersecurity risk, vulnerability remediation strategies, security architecture, or endpoint-security decisions.
- Microsoft and/or Linux certifications, such as Microsoft Certified Solutions Expert, Red Hat Certified System Administrator, CompTIA Linux+, or equivalent.