Application Engineer Expert Level

Integrity Technology•Fort Meade, MD

11d

About The Position

ITC is a Woman Owned Small Business delivering exceptional consultation to the U.S. Government in Systems/Software Engineering, Cybersecurity Solutions, Mission Operations/INTEL Analysis, and Management Services in order to enable our customers to solve the most challenging problems. With continued growth comes opportunity, and we are currently searching for a Top-Secret SCI with polygraph-cleared Expert-Level Application Engineer. As part of the Secure the Enterprise initiative, develop capabilities to shift from the current manual system security evaluation and authorization process to a new model that emphasizes automation, streamlined processes and approvals, continuous monitoring and assessment, and network data gathering across the entire life cycle of a project. Deploy, configure, test, manage, and optimize endpoint detection and response solutions across the NSA enterprise. Establish comprehensive Standard Operating Procedures (SOPs) for EDR functionalities and lead training sessions to empower SOC analysts in maximizing platform efficiency and threat visibility. Responsible to the deployment, testing, management, and optimization of endpoint detection and response solutions. This role involves deploying, configuring, testing, and monitoring EDR capabilities to traditional on premises and cloud environments. The ideal candidate should have a strong background in endpoint security, cloud applications, Windows forensics, large enterprise endpoint deployments, and SOC analyst support.

Requirements

Must already possess an active TS/SCI with Full Scope Polygraph in order to be considered
Twelve (12) years minimum experience and a High School Diploma/GED.
Ten (10) years minimum experience and an Associate's Degree.
Eight (8) years minimum experience and a Bachelor's Degree.
Six (6) years minimum experience and a Master's Degree.
Four (4) years minimum experience and a Doctorate's Degree.
Proficient in one or more EDR platforms (Trellix HX/EDRF or Microsoft Defender for Endpoint EDR, preferably both).
Experience with cloud security and familiarity with cloud service providers (AWS or Azure, preferably both).
Experience securing cloud-hosted workloads using EDR solutions and understanding cloud-native security controls and logging (Microsoft Sentinel, Microsoft Defender, Microsoft Purview, AWS CoudWatch, AWS CloudTrail, AWS GuardDuty, or AWS Security Hub).
CCSP Certified Cloud Security Professional certification or equivalent.
Experience supporting SOC functions such as assisting in monitoring, training analysts, documenting SOPs, incident response coordination, analysis of security events, and process/procedure improvement.
Microsoft Certified: Security Operations Analyst Associate (SOAA) or equivalent.
Understanding of network protocols, traffic analysis, and intrusion detection systems (CompTIA Security+ is required).
In-depth knowledge of Windows operation system internals, registry, and file system.
Familiarity with forensic tools like EnCase, FTK, or open-source alternatives.
SANS Windows Forensic Analysis (FOR500) or equivalent.

Nice To Haves

Threat Hunting: Proactive identification and investigation of potential security threats and anomalies.
Incident Response: Experience in managing and responding to security incidents, including containment, eradication, and recovery.
Security Information and Event Management (SIEM): Familiarity with SIEM systems for log analysis and correlation (e.g. Splunk, Elastic, Microsoft Sentinel).
Scripting and Automation: Proficient in scripting languages (e.g., PowerShell, Python) for automating tasks and workflows.
Certified Information Systems Security Professional (CISSP)
Microsoft 365 Certified: Endpoint Administrator Associate (MD-102)

Responsibilities

Develop capabilities to shift from the current manual system security evaluation and authorization process to a new model that emphasizes automation, streamlined processes and approvals, continuous monitoring and assessment, and network data gathering across the entire life cycle of a project.
Deploy, configure, test, manage, and optimize endpoint detection and response solutions across the NSA enterprise.
Establish comprehensive Standard Operating Procedures (SOPs) for EDR functionalities and lead training sessions to empower SOC analysts in maximizing platform efficiency and threat visibility.
Responsible to the deployment, testing, management, and optimization of endpoint detection and response solutions.
Deploying, configuring, testing, and monitoring EDR capabilities to traditional on premises and cloud environments.