Endpoint Security Analyst – Elastic Defend

About the role

The C5ISR Center Cyber Security Service Provider (CSSP), a defensive cyber operations organization supporting the Department of War, is hiring an experienced Endpoint Security Analyst through Leidos. You will support a strategic Cybersecurity Task Order by providing expertise in Elastic Agent and Elastic Defend, helping deploy, configure, optimize and sustain endpoint protection, telemetry collection, threat detection and automated response across the enterprise. The position is hybrid, with three days on site at Adelphi, and requires U.S. citizenship with an active TS/SCI clearance with SAP eligibility.

Key responsibilities

• Deploy, configure, operate, tune, upgrade and troubleshoot Elastic Agent, Elastic Defend and other enterprise endpoint security technologies.
• Optimize endpoint protection and telemetry collection to maximize visibility and detection while minimizing performance impact.
• Partner with Threat and Detection teams to customize detection rules, develop threat signatures and align defenses with threat intelligence and MITRE ATT&CK techniques.
• Conduct host-based defensive cyber operations to identify, investigate, contain, mitigate and remediate vulnerabilities and intrusions.
• Support cyber investigations with advanced endpoint queries, forensic data collection and rapid response.
• Build and maintain queries, dashboards and reports for enterprise security visibility.
• Coordinate with engineering teams on deployments, patches, hot fixes and upgrades, and troubleshoot tool issues and outages.
• Develop endpoint security policies, configurations and SOPs, and evaluate new tools and technologies.

Required profile

• Bachelor's degree in STEM, cybersecurity or a related field and 4+ years of relevant cybersecurity experience.
• Hands-on experience deploying, configuring, operating or supporting enterprise endpoint security or EDR solutions.
• Strong understanding of endpoint protection, telemetry, threat detection, incident investigation and response.
• Knowledge of current threats, attacker techniques and defensive strategies, including the MITRE ATT&CK framework.
• U.S. citizenship and an active TS/SCI with SAP eligibility.
• At least one certification: GIAC/SANS, Offensive Security, ISC2, EC-Council or C-Council.

Required skills

• Preferred: hands-on experience with Elastic Agent and Elastic Defend, including tuning and troubleshooting.
• Preferred: experience with CrowdStrike Falcon, McAfee/Trellix ePO, Tanium or similar platforms.
• Preferred: experience developing detection rules, threat signatures, IOCs and IOAs, and tuning endpoint telemetry.