About SHR Consulting Group SHR Consulting Group, LLC is a small business delivering enterprise IT, cybersecurity, and program management services to the Department of Defense and federal civilian agencies. We support mission-critical infrastructure at the Pentagon and across the National Capital Region, and we invest in our people through competitive compensation, professional certification support, and long-term career growth on stable, multi-year programs. Position Summary SHR Consulting Group is seeking a hands-on Lead Endpoint Engineer - MECM/SCCM to support DISA J-6/J-9. This position leads enterprise MECM operations and a team of MECM administrators responsible for endpoint imaging, operating system deployment, application packaging, software update management, vulnerability remediation, configuration compliance, and MECM infrastructure sustainment. The Lead will use MECM as a primary enterprise tool to rapidly remediate vulnerabilities and configuration deficiencies across Windows endpoints in OSD forest, OMS, and Platform Management domains operating on NIPRNet, SIPRNet, TS-C, and JWICS networks. The role requires strong technical leadership, extensive hands-on MECM expertise, and the ability to coordinate closely with Cyber Compliance, DCO, infrastructure teams, and government stakeholders to meet DISA STIG, IAVM, CTO, FRAGO, and other cyber-tasking suspense requirements. This lead will be responsible for directing the MECM administrators, owning task assignment and work prioritization, serving as the team’s technical escalation point, and representing endpoint management status to the Government. Work location is onsite at the Pentagon and requires an active Top Secret clearance.
Key Responsibilities
Team Leadership and MECM Operations
- Lead the MECM team, including work assignment, technical oversight, mentoring, quality assurance, and escalation support for MECM Intermediate SMEs and System Administrators.
- Serve as the authoritative technical point of contact for MECM operations, enterprise endpoint-management capabilities, and vulnerability-remediation execution.
- Establish and maintain standard operating procedures, deployment standards, testing requirements, rollback plans, and change-control documentation for MECM services.
- Coordinate with DISA J-6/J-9, Cyber Compliance/IA personnel, DCO, server, network, database, and application teams to resolve endpoint-management issues and execute enterprise remediation initiatives.
- Brief MECM operational status, vulnerability-remediation progress, technical risks, and decisions required to DISA J-6/J-9 leadership and the Monthly Integrated Product Review (IPR).
Vulnerability Remediation and Patch Management
- Own an aggressive vulnerability-remediation posture using MECM to package, test, deploy, validate, and report remediation for patches, hotfixes, cumulative updates, third-party software updates, configuration changes, and security baselines.
- Drive remediation of DISA Security Technical Implementation Guide (STIG) findings, Information Assurance Vulnerability Management (IAVM) notices, Cyber Tasking Orders (CTOs), FRAGOs, and other cyber tasking within or ahead of established suspense dates.
- Use MECM Software Update Management, compliance baselines, configuration items, PowerShell scripts, task sequences, and Group Policy changes to remediate vulnerabilities and configuration deficiencies.
- Establish and maintain automated deployment rings, phased rollout strategies, pilot groups, maintenance windows, and emergency-patching procedures that balance remediation speed with operational stability.
- Prioritize remediation based on vulnerability severity, exploitability, asset criticality, affected endpoint population, IAVM suspense, mission impact, and available compensating controls.
- Correlate MECM deployment and compliance data with ACAS/Tenable scan results, Trellix endpoint-security data, and other cyber-tool outputs to identify remediation gaps and validate closure.
- Support POA&M development and updates; provide technical evidence, deployment results, scan validation, and remediation artifacts for CCORI, inspections, audits, and cyber compliance reviews.
Imaging and Operating System Deployment
- Design, develop, maintain, and troubleshoot MECM Operating System Deployment (OSD) capabilities for enterprise Windows endpoints.
- Build and sustain task sequences for new system deployment, hardware refresh, operating system upgrades, break/fix replacement, reimaging, security-tool installation, domain join, baseline configuration, and post-build application deployment.
- Manage and maintain operating system images, boot images, driver packages, driver-selection logic, PXE services, boot media, user-state migration processes, and supporting deployment content.
- Develop automated endpoint-build processes that reduce technician touch time, improve deployment consistency, and ensure systems are configured to approved security and operational standards.
- Troubleshoot OSD failures involving PXE, boot images, task sequences, driver injection, content availability, network connectivity, certificates, domain join, and post-build software installation.
- Coordinate imaging and deployment support during hardware lifecycle refreshes, Windows version upgrades, and major enterprise technology transitions.
Application Packaging and Software Deployment
- Package, test, deploy, and maintain enterprise applications using MECM application-management capabilities, MSI, EXE, PowerShell, scripts, and other approved installation methods.
- Develop application detection methods, requirement rules, dependencies, supersedence relationships, return-code handling, uninstall procedures, and user-experience settings.
- Maintain application deployment standards and packaging documentation to ensure consistent, reliable, and auditable software delivery.
- Coordinate with application owners, cybersecurity personnel, and system stakeholders to deploy application upgrades, emergency patches, vulnerable-software removals, and security configuration changes.
- Validate applications in pilot and phased-deployment rings before broad enterprise release; monitor deployments and rapidly address failures or unintended operational impacts.
- Maintain software catalog accuracy, deployment content, and distribution-point availability to support timely enterprise application delivery.
MECM Infrastructure and Platform Sustainment
- Administer, maintain, and modernize enterprise MECM infrastructure, including site servers, management points, distribution points, software update points, WSUS integration, SQL Server back-end components, reporting services, and associated Windows Server infrastructure.
- Ensure MECM infrastructure remains healthy, secure, patched, backed up, recoverable, and capable of meeting Group 1 restoration timelines.
- Monitor and troubleshoot MECM site health, component status, client communication, content distribution, replication, software update synchronization, database performance, certificate status, and endpoint-management service availability.
- Lead root-cause analysis and service restoration for MECM outages and performance issues, including failures related to SQL Server, WSUS, site components, distribution points, boundary groups, PKI, Active Directory, Group Policy, and client communication.
- Maintain MECM current branch releases, hotfixes, cumulative updates, management packs, supporting Windows Server updates, and required security configurations.
- Manage MECM backup, recovery, and restoration processes, ensuring backups are retained and stored away from the physical system in accordance with applicable policy and continuity requirements.
- Plan, coordinate, test, and execute MECM upgrades, server refreshes, distribution-point migrations, and infrastructure lifecycle activities through the DISA J-6/J-9 Enterprise Change Management framework.
Automation, Reporting, and Compliance Metrics
- Develop and maintain PowerShell automation for patch deployment, vulnerability remediation, client-health correction, application deployment, inventory collection, reporting, and administrative tasks.
- Create and sustain MECM task sequences, compliance baselines, configuration items, collections, queries, and deployment workflows that automate endpoint remediation at scale.
- Produce weekly Microsoft Endpoint Operational Status and vulnerability-remediation metrics, including client health, software update compliance, deployment success rates, imaging status, application deployment status, and aging vulnerabilities.
- Develop and maintain reports and dashboards using MECM reporting, SQL Server Reporting Services (SSRS), SQL queries, and/or Power BI.
- Analyze remediation trends and recurring deployment failures; recommend process, automation, infrastructure, or policy improvements to improve compliance and reduce vulnerability aging.
Minimum Qualifications
- Seven (7) or more years of hands-on experience administering MECM/SCCM at enterprise scale, including experience serving as a senior technical authority, technical lead, or team lead.
- Demonstrated experience leading or mentoring systems administrators, endpoint-management personnel, or technical teams.
- Demonstrated experience using MECM to execute vulnerability remediation and improve patch compliance against DoW STIGs, IAVMs, DTOs, FRAGOs, or comparable cyber tasking within mandated timelines.
- Expert-level knowledge of MECM software update management, application packaging, application deployment, OS deployment/imaging, task sequences, compliance baselines, client health, and endpoint troubleshooting.
- Hands-on experience building and supporting MECM operating system deployment solutions, including task sequences, boot images, driver packages, PXE, and endpoint provisioning workflows.
- Hands-on experience packaging and deploying enterprise applications, including detection methods, dependencies, supersedence, installation scripting, and deployment troubleshooting.
- Strong experience administering MECM infrastructure, including site servers, management points, distribution points, software update points/WSUS, SQL Server, SSRS, Active Directory, Group Policy, Windows Server, and PKI.
- Strong PowerShell scripting skills for automation of endpoint remediation, software deployment, reporting, and administrative operations.
- Experience producing and interpreting MECM operational reporting through SSRS, SQL Server, Power BI, or equivalent reporting tools.
- Experience integrating or correlating MECM data with cyber tools, including ACAS/Tenable and Trellix EDR or equivalent vulnerability-management and endpoint-security platforms.
- Working knowledge of RMF, POA&M management, CCORI/inspection readiness, and DoD cyber tasking processes.
- Excellent troubleshooting, written communication, verbal communication, leadership, and customer-briefing skills.
Education & Certifications
- Bachelor’s degree in Computer Engineering, Computer Information Systems, Telecommunications, Management Information Systems, Cybersecurity and seven (7) recent years of documented relevant experience.
- DoD 8570.01-M / DoD 8140 IAT Level II baseline certification requirements, such as Security+ CE, CCNA-Security, CySA+, GICSP, GSEC, or equivalent.
- Computing Environment certification appropriate to the role, such as a current Microsoft endpoint-management or Windows Server certification, is required.
Security Clearance
- U.S. Citizenship.
- Active Top Secret clearance.
Work Environment
- 100% onsite at a government facility within the National Capital Region, primarily at the Pentagon, Crystal Gateway, Taylor Building, Mark Center, or another DISA J-6/J-9-designated alternate site.
- Candidate must reside in the DC Metro Area and have reliable transportation.
- Must comply with all DoD, DISA, and DISA J-6/J-9 security and access protocols, including the ability to access NIPRNet and SIPRNet environments.
Benefits
- Competitive salary commensurate with experience and clearance level.
- Comprehensive medical, dental, and vision coverage.
- 401(k) with company contribution.
- Paid time off and eleven federal holidays.
- Certification reimbursement and training support.
- Life and disability insurance.
Salary Range 150,000 – 180,000 USD. The salary range represents a general guideline; SHR considers a number of factors when determining the base salary offers such as the scope and responsibilities of the position, and the candidate's experience, education, skills and current market conditions. SHR Consulting Group, LLC is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or protected veteran status
