Posting/External Job Title
Cyber Engineer - Endpoint Security
Location
Colorado Springs, CO 81919 US
Schriever Space Force Base, CO 80930 US (Primary)
Remote/Onsite/Hybrid
100% Onsite
Job Type
Full-time
# of Hires Needed
1
Education
None
Travel
Up to 10%
Security Clearance Required
TS
Pay Range (All offers will be based on experience)
$150,000 - $170,000/yr.
Position Introduction/Key Duties
Cimarron is seeking a
Cyber Engineer - Endpoint Security to support the Missile Defense Agency (MDA) on the Integrated Research and Development for Enterprise Solutions (IRES) contract at Schriever Space Force Base in the Colorado Springs, CO area.
Key Duties:- Administer, configure, maintain, troubleshoot, and sustain endpoint-security tools and services in support of mission systems and DoW cybersecurity requirements.
- Support endpoint-security operations using Elastic Defend, including configuration, policy management, agent deployment and health, alerting, troubleshooting, logging, reporting, and coordination with system owners and administrators.
- Investigate and resolve endpoint-security tool issues; support endpoint policy management, agent deployment and health, alerting, logging, reporting, and coordination with affected system owners and administrators.
- Develop and maintain endpoint-security engineering documentation, Standard Operating Procedures (SOPs), configuration baselines, implementation plans, troubleshooting guides, and sustainment artifacts.
- Coordinate with Cyber compliance, vulnerability-management, and system-administration personnel to support implementation of applicable cybersecurity requirements, directives, remediation actions, and continuous-monitoring activities.
- Work with Cyber team leads, Information System Security Managers (ISSMs), system administrators, network engineers, and Systems Engineering personnel to ensure endpoint-security capabilities support mission, operational, and security requirements.
- Provide backup, surge, and project-based support to the Systems Engineering team for enterprise Elastic engineering efforts, as mission priorities require.
- Support may include technical coordination, configuration assistance, troubleshooting, documentation, integration activities, and designated implementation projects.
Required/Desired Skills, Experience, and Education
Required Skills, Experience, and Education:- Due to facility security requirements, only U.S. citizens are eligible for consideration at this time.
- This position requires access to federal facilities. Candidates must possess a valid, unexpired Real ID-compliant driver's license or state-issued identification card at the time of hire. If you are unsure whether your ID is Real ID-compliant, please check for the star symbol in the upper portion of your driver's license or state ID.
- Active Top Secret Security Clearance with SCI eligibility.
- 8 or more years of general (full-time) work experience.
- May be reduced with completion of advanced education.
- 6 or more years of directly related experience.
- 2 or more years of experience working in a management or leadership role.
- Hold current DoW 8570.01-M IAT Level II certification, such as CompTIA Security+.
- Experience administering, configuring, troubleshooting, deploying, or sustaining enterprise endpoint-security tools in a DoW or similarly regulated environment.
- Experience with cybersecurity processes, procedures, and tools used for endpoint protection, vulnerability management, monitoring, logging, or data correlation, such as Trellix ESS/ePO, ACAS, Elastic, ArcSight, or comparable technologies.
Desired Skills, Experience, and Education:- Experience deploying, configuring, and using Elastic Kibana visualization dashboards to support cybersecurity monitoring, analysis, reporting, and operational awareness.
- Experience using and configuring Elastic Cloud features, including X-Pack capabilities such as security, alerting, monitoring, reporting, and role-based access controls.
- Experience developing, configuring, and customizing Elastic/ELK Stack components-including Elasticsearch, Logstash, and Kibana-to support enterprise monitoring, log aggregation, visualization, alerting, and cybersecurity operations.
- Hands-on experience with Elastic Defend, Elastic Security, Elastic Stack, Elastic Cloud Enterprise, or comparable enterprise security information and event-management or endpoint-detection-and-response capabilities.
- Experience supporting Prisma Cloud and container-security capabilities, including container and image vulnerability management, compliance monitoring, runtime protection, alerting, troubleshooting, and integration with enterprise cybersecurity monitoring processes.
- Basic working knowledge of Linux operating systems, including command-line navigation, file and directory management, permissions, process and service monitoring, log review, package management, and basic troubleshooting.
- Experience with Trellix Endpoint Security Suite, Trellix ePolicy Orchestrator (ePO), Host-Based Security System (HBSS), or comparable endpoint-security management platforms.
- Experience supporting a cybersecurity-tool migration, endpoint-security platform transition, agent migration, policy conversion, testing, validation, or operational rollout.
- Familiarity with DoW cybersecurity operations, vulnerability management, DISA Cyber Tasking Orders (CTOs), Information Assurance Vulnerability Alerts (IAVAs), Security Technical Implementation Guides (STIGs), and continuous-monitoring activities.
- Familiarity with Risk Management Framework (RMF) processes, NIST SP 800-53 controls, security documentation, and Authority to Operate (ATO) sustainment activities.
- 1 or more advanced certifications: CompTIA CySA+, CASP+, CISSP, GIAC certifications, or other advanced DoW 8570-alignedcertifications.
- Experience supporting enterprise engineering teams through technical integration, logging and telemetry onboarding, troubleshooting, implementation projects, or operational surge support.
- Demonstrated ability to work independently, manage competing priorities, collaborate across technical teams, and support mission-critical operations.
This position is anticipated to close to applications on November 15, 2026. If the application window is extended, this posting will be updated.
Resumes should list employment dates in month/year format (e.g., January 2020 - March 2024) for each position to meet customer and contract documentation requirements.
