Cyber Engineer – Endpoint Security MDX - SSFB

Amentum•Colorado Springs, CO

1d•$155,000 - $175,000•Onsite

About The Position

The Cyber Engineer – Endpoint Security is part of Amentum’s Missile Defense Division and directly supports the Missile Defense Agency (MDA) as part of the MDSEA Cyber Team. This is the primary endpoint-security engineering role supporting Elastic Defend. The engineer administers, troubleshoots, documents, sustains, and improves endpoint-security capabilities while balancing operational requirements with modernization efforts. The role involves close collaboration with cybersecurity, systems engineering, infrastructure, system-administration, and mission stakeholders. Limited backup, surge, and project support for enterprise Elastic engineering may also be required as mission priorities dictate. The position is onsite at Schriever Space Force Base in Colorado Springs, Colorado. Remote work is not available, relocation assistance is not available, and travel may be required up to 10% of the time. The position requires an active DoW Top Secret security clearance with SCI eligibility and a current DoW 8570.01-M IAT Level II certification. Resumes submitted with the application must use month-and-year date formatting. The selected candidate may be assigned as an employee of one of Amentum’s teammate companies.

Requirements

At least 8 years of general full-time work experience; this requirement may be reduced with advanced education.
At least 6 years of directly related experience.
At least 2 years of experience in a management or leadership role.
Current DoW 8570.01-M IAT Level II certification, such as CompTIA Security+.
Experience administering, configuring, troubleshooting, deploying, or sustaining enterprise endpoint-security tools in a DoW or similarly regulated environment.
Experience with cybersecurity processes, procedures, and tools for endpoint protection, vulnerability management, monitoring, logging, or data correlation, such as Trellix ESS/ePO, ACAS, Elastic, ArcSight, or comparable technologies.
Active DoW Top Secret security clearance with SCI eligibility.

Nice To Haves

Experience deploying, configuring, and using Elastic Kibana visualization dashboards for cybersecurity monitoring, analysis, reporting, and operational awareness.
Experience using and configuring Elastic Cloud features, including X-Pack security, alerting, monitoring, reporting, and role-based access controls.
Experience developing, configuring, and customizing Elasticsearch, Logstash, Kibana, or other Elastic/ELK Stack components for enterprise monitoring, log aggregation, visualization, alerting, and cybersecurity operations.
Hands-on experience with Elastic Defend, Elastic Security, Elastic Stack, Elastic Cloud Enterprise, or comparable enterprise SIEM or EDR capabilities.
Experience supporting Prisma Cloud and container security, including container and image vulnerability management, compliance monitoring, runtime protection, alerting, troubleshooting, and integration with cybersecurity monitoring processes.
Basic working knowledge of Linux, including command-line navigation, file and directory management, permissions, process and service monitoring, log review, package management, and basic troubleshooting.
Experience with Trellix Endpoint Security Suite, Trellix ePolicy Orchestrator (ePO), HBSS, or comparable endpoint-security management platforms.
Experience supporting cybersecurity-tool migrations, endpoint-security platform transitions, agent migrations, policy conversion, testing, validation, or operational rollouts.
Familiarity with DoW cybersecurity operations, vulnerability management, DISA Cyber Tasking Orders, IAVAs, STIGs, and continuous-monitoring activities.
Familiarity with RMF processes, NIST SP 800-53 controls, security documentation, and ATO sustainment activities.
One or more advanced certifications, such as CompTIA CySA+, CASP+, CISSP, GIAC certifications, or other advanced DoW 8570-aligned certifications.
Experience supporting enterprise engineering teams through technical integration, logging and telemetry onboarding, troubleshooting, implementation projects, or operational surge support.
Demonstrated ability to work independently, manage competing priorities, collaborate across technical teams, and support mission-critical operations.

Responsibilities

Administer, configure, maintain, troubleshoot, and sustain endpoint-security tools and services in support of mission systems and DoW cybersecurity requirements.
Support Elastic Defend operations, including configuration, policy management, agent deployment and health, alerting, troubleshooting, logging, reporting, and coordination with system owners and administrators.
Investigate and resolve endpoint-security tool issues and support endpoint policy management, agent health, alerting, logging, and reporting.
Develop and maintain endpoint-security engineering documentation, including SOPs, configuration baselines, implementation plans, troubleshooting guides, and sustainment artifacts.
Coordinate with cyber compliance, vulnerability-management, and system-administration personnel on cybersecurity requirements, directives, remediation actions, and continuous monitoring.
Collaborate with Cyber team leads, ISSMs, system administrators, network engineers, and Systems Engineering personnel to align endpoint-security capabilities with mission, operational, and security requirements.
Provide backup, surge, and project-based support for enterprise Elastic engineering, including technical coordination, configuration assistance, troubleshooting, documentation, integration, and designated implementation projects.
Develop clear technical documentation and communicate effectively with cybersecurity personnel, system administrators, engineers, management, and mission stakeholders.