Endpoint Security / ESS Engineer (Journeyman)

DecisionPoint | Cortek•Chicago, IL

2d•Remote

About The Position

DecisionPoint seeks a Journeyman Endpoint Security / ESS Engineer to support endpoint-security administration, policy enforcement, agent health, compliance reporting, and security-event investigation for the USMEPCOM ENLIST program. The engineer will serve as a McAfee endpoint-security specialist supporting the Department of Defense Endpoint Security Solutions environment. The position investigates security events, unhealthy agents, policy failures, and endpoint-compliance issues; implements approved corrective actions; and validates that required endpoint protections remain operational and effective. The role coordinates agent deployment and endpoint remediation with Task 4 infrastructure personnel, supports cybersecurity incident reporting, and maintains technical evidence for security-control and authorization activities. The position is remote, with a preference for candidates located in the Chicago area. Applicants acknowledge that their resume may be included in an active competitive government contract bid.

Requirements

Active Secret clearance or higher.
Bachelor’s degree in Cybersecurity, Information Systems, or a related field.
At least 7 years of relevant cybersecurity, endpoint-security, information-assurance, or information-security experience.
Current CompTIA Security+ certification.
Hands-on experience administering or supporting McAfee endpoint-security technologies.
Strong troubleshooting, analytical, documentation, communication, and cross-functional coordination skills.
Ability to manage multiple endpoint-security events, remediation activities, and technical dependencies in a structured enterprise environment.

Nice To Haves

Experience supporting DoD Endpoint Security Solutions in an enterprise environment.
Experience with McAfee or Trellix ePolicy Orchestrator, Endpoint Security, McAfee Agent, threat-prevention modules, firewall policies, and web-control capabilities.
Experience monitoring and remediating unhealthy, inactive, noncommunicating, or noncompliant endpoint agents.
Experience troubleshooting agent deployment, policy enforcement, signature updates, content distribution, and endpoint-protection failures.
Experience analyzing endpoint-security events, alerts, logs, dashboards, and compliance reports.
Experience coordinating endpoint remediation with infrastructure, desktop-support, network, application, and cybersecurity teams.
Familiarity with Host Based Security System technologies or legacy McAfee capabilities used within DoD environments.
Experience supporting cybersecurity incident analysis, evidence collection, escalation, and reporting.
Knowledge of the DoD Risk Management Framework, NIST SP 800-53 controls, DISA Security Technical Implementation Guides, and applicable DoD endpoint-security requirements.
Experience providing technical evidence for ATO, ATC, security-control assessment, audit, or inspection activities.
Familiarity with ACAS or Tenable, STIG Viewer, SCAP tools, eMASS, ServiceNow, or comparable cybersecurity and workflow platforms.
Experience reconciling endpoint-agent status with configuration-management or asset-inventory records.
Experience developing endpoint-compliance reports, agent-health metrics, event trends, and remediation dashboards.
Additional certifications such as CySA+, CASP+, CISSP, Trellix product certifications, or equivalent cybersecurity credentials.
Familiarity with current DoD 8140 cybersecurity workforce qualification requirements.

Responsibilities

Serve as a technical specialist for McAfee/Trellix endpoint-security technologies supporting the DoD Endpoint Security Solutions environment.
Administer, configure, maintain, and monitor approved endpoint-security tools and services.
Implement and maintain approved endpoint-security policies, configurations, exclusions, rules, and enforcement settings.
Monitor endpoint agents for connectivity, communication, deployment, update, and operational-health issues.
Investigate unhealthy, inactive, noncommunicating, outdated, or improperly configured endpoint agents.
Diagnose policy-enforcement failures, update failures, deployment errors, and endpoint-protection gaps.
Implement Government-approved corrective actions and validate restoration of endpoint protections.
Review ESS reports and dashboards to identify security events, compliance issues, policy failures, and remediation needs.
Investigate endpoint-security alerts and events and coordinate response activities with cybersecurity, infrastructure, application, and Government teams.
Coordinate McAfee/Trellix agent deployment, upgrade, repair, removal, and replacement activities with Task 4 infrastructure personnel.
Support endpoint remediation involving operating-system configurations, security policies, agents, signatures, content updates, and approved software.
Confirm endpoints receive required policies, signatures, content, and product updates.
Validate endpoint compliance after remediation, configuration changes, maintenance, or agent deployment.
Track endpoint-security findings, owners, corrective actions, dependencies, deadlines, and closure evidence.
Support vulnerability remediation related to endpoint-security configurations, agent health, or protection status.
Collect and maintain logs, screenshots, reports, configuration information, and other remediation and compliance evidence.
Create and update incident, problem, change, and remediation tickets in the designated workflow platform.
Support cybersecurity incident reporting by gathering endpoint data, event details, logs, timelines, and investigative evidence.
Escalate significant events, persistent policy failures, widespread agent-health issues, and unresolved compliance deficiencies.
Coordinate with system administrators and asset-management personnel to reconcile endpoint records, agent status, and authoritative inventories.
Support security-control testing and provide endpoint-security evidence for RMF, ATO, ATC, audit, and inspection activities.
Develop endpoint-security compliance reports, agent-health summaries, event metrics, trend analyses, and briefing materials.
Maintain endpoint-security procedures, configuration documentation, standard operating procedures, troubleshooting guides, and technical knowledge articles.
Recommend technical and process improvements to strengthen endpoint protection, agent health, monitoring, and compliance reporting.