SITEC - Cyber Endpoint Security Systems Engineer - MacDill AFB

Peraton•MacDill AFB, FL

9d•Onsite

About The Position

Peraton is hiring a Cyber Endpoint Security Systems Engineer to support the Special Operation Command Information Technology Enterprise Contract (SITEC) 3 Enterprise Operations and Maintenance Task Order. The position is located at MacDill AFB in Florida and supports USSOCOM, its Component Commands, Theater Special Operations Commands, and deployed forces with IT operations and maintenance services. The engineer is responsible for technical architecture, detection engineering, automated integration, platform modernization, and attack surface reduction across enterprise endpoint ecosystems. The role engineers and scales endpoint security platform infrastructure, develops detection-as-code capabilities, architects API integrations, and builds automated containment workflows to strengthen defensive posture while minimizing operational overhead.

Requirements

Minimum experience: 12 years with a high school diploma, 10 years with an associate degree, or 8 years with a bachelor's degree.
A DoW TS/SCI clearance is required.
Security+ certification is required.
Must be DoW 8140 compliant under Work Role Code 462 – Control Systems Security Specialist, Intermediate level or higher.

Nice To Haves

Endpoint Security Platform Management
Threat Detection and Analysis
Security Automation and Scripting
SIEM Integration and Optimization
Cloud Security Principles
Network and System Fundamentals
Compliance and Security Frameworks
Problem Solving and Troubleshooting
Technical Documentation
Continuous Learning and Adaptability

Responsibilities

Architect, test, and deploy resilient, high-availability enterprise endpoint security platform topologies, including clustered databases and load-balanced Agent Handlers.
Lead strategic modernization initiatives, including re-architecting legacy on-premises endpoint security infrastructure.
Design and test migration paths for legacy point products.
Engineer multi-platform agent compatibility across enterprise operating systems, microservices, containerized workloads, and non-persistent VDI environments.
Develop platform sizing, compute and storage scalability models, network bandwidth throttles, and disaster recovery architectures for endpoint security management systems.
Develop, test, and deploy custom behavioral detection rules mapped to the MITRE ATT&CK framework.
Engineer host-level Attack Surface Reduction baselines, including WDAC, Trellix Application Control/Solidcore execution control, Credential Guard, Exploit Guard, and Linux kernel security modules.
Establish and govern the policy lifecycle for exclusions, behavioral suppression rules, and tamper-protection configurations before operational handoff to Administrators.
Design endpoint telemetry streaming pipelines to route endpoint events into SIEM and data lake environments in collaboration with the Cyber Analytics Systems Engineer.
Operationalize threat intelligence indicators and hunt findings into durable detection signatures and automated containment triggers in collaboration with the Cyber Threat Hunter.
Serve as the Tier 3 engineering escalation tier for OS compatibility bugs, kernel panic/BSOD triage, memory leaks, and complex defensive-agent driver interactions.
Author engineering specifications, platform migration guides, detection-as-code CI/CD pipelines, and operational runbooks for transition to the Cyber Endpoint Security Systems Administrator.