Senior Endpoint Security Systems Engineer

Senior Endpoint Security Systems Engineer
Adelphi, MD (Hybrid 3 days onsite) | Full-Time | Active TS/SCI Required

Our client seeking a Senior Endpoint Security Systems Engineer to support the C5ISR Center Cyber Security Service Provider (CSSP) program. In this role, you'll lead the engineering, deployment, and sustainment of enterprise host-based defense capabilities across mission assets, with a primary focus on our Trellix environment (ePolicy Orchestrator and Endpoint Security suite) and a secondary focus on operationalizing Elastic Defend for Endpoint as part of a multi-tiered defense architecture. You'll work closely with mission system owners, infrastructure architects, and defensive cyber operations teams to protect Windows, Linux, and macOS platforms across on-premises environments and cloud IaaS.

If this sounds someones like you, Apply Now! Feel free to call/text me at 469-9771067 or email me at

What You'll Do

• Administer, upgrade, and harden central endpoint management consoles (primarily Trellix ePO) across multi-tier networks, isolated enclaves, and cloud-connected management VPCs
• Engineer and sustain the Trellix suite alongside Elastic Agent/Elastic Defend, managing agent lifecycle, compatibility, and synchronized host-level protection
• Direct endpoint and server integration across on-premises and cloud IaaS instances (Windows, Linux, macOS)
• Design, benchmark, and deploy scan exclusion policies, behavioral rules, DLP rules, and content updates that protect hosts without degrading performance
• Troubleshoot agent connectivity, registration, and communication failures across hybrid network boundaries; resolve product installation and deployment issues
• Partner with mission owners to engineer precise exclusions and resolve application conflicts caused by security policies
• Investigate and correct ePO console misconfigurations, policy inheritance errors, and database issues
• Maintain compliance with DISA STIGs, OPORD, and endpoint security requirements, supporting continuous monitoring reporting
• Collaborate with CSSP threat detection and hunt teams to implement custom endpoint signatures, IOCs, and automated containment policies

Required Qualifications

• Active Top Secret/SCI clearance (U.S. citizenship required); Secret active to start acceptable
• Bachelor's degree in Cybersecurity, Computer Science, or a related STEM/IT field with 8+ years of relevant systems engineering/endpoint security experience, OR a Master's degree with 6+ years
• DoD 8140 compliance upon start: an active certification meeting CSSP-Infrastructure Support, CSSP-Analyst, or IAT Level II/III requirements (e.g., CEH, CySA+, GCIH, GCFA, GMON, CISSP, CASP+, or CISM)
• Hands-on experience administering and upgrading Trellix ePolicy Orchestrator (ePO), Trellix Agent, and core modules including Endpoint Security (Threat Prevention and Firewall), Data Loss Prevention (DLP), and Policy Auditor
• Proven experience deploying and maintaining endpoint security agents across enterprise Linux (RHEL/CentOS/Rocky), Windows (Server and Desktop), and macOS environments
• Practical experience managing and troubleshooting host-based security across on-premises and cloud IaaS (VM) instances
• Strong troubleshooting skills for OS performance impacts, resource contention, and agent-server communication across complex network topologies

Preferred Qualifications

• Experience with Trellix Solidcore (Application Control) for application whitelisting and file integrity monitoring (FIM)
• Hands-on experience deploying, configuring, and tuning Elastic Agent and Elastic Defend for Endpoint
• Familiarity with macOS enterprise security configurations and deployment tools (Apple MDM, JAMF Pro)
• Experience integrating or reporting endpoint security posture into DISA COAMS and CMRS
• Familiarity with cloud networking, auto-scaling, and security groups in AWS, Azure, or GCP
• Scripting ability in PowerShell, Bash, or Python for automating agent installation, verification, and health monitoring
• Working knowledge of the MITRE ATT&CK framework and its application to host-based detections