Endpoint Security Solutions Lead SME

Product Manager SME – Endpoint Security Solutions Lead Everforth ECS is seeking a Product Manager SME to work in the National Capital Region covering the Pentagon, Falls Church, and Fairfax. Please Note: This position is contingent upon contract award. The War Data Platform (WDP) is a key initiative within the U.S. Department of War's (DoW) AI‑First strategy introduced in early 2026. The WDP focuses on operational warfighting data and aims to accelerate the deployment of artificial intelligence (AI) on the battlefield. The WDP extends to Unclassified, Secret, and Top Secret environments, and supports collaboration between Combatant Commands, Joint Staff directorates, Senior Executive Service leaders, and operational analysts. Responsibilities The Endpoint Security Solutions Lead SME is a senior subject matter expert responsible for leading enterprise endpoint protection, detection, and response operations across WDP-supported DoW mission systems in unclassified and classified environments. Leads enterprise endpoint security operations supporting Department of War mission systems across unclassified and classified environments. Operates and sustains endpoint protection platforms including Host‑Based Security System, antivirus services, endpoint detection and response tooling, and compliance monitoring agents deployed across workstation and server fleets. Configures and tunes endpoint security policies to enforce DoW cybersecurity baselines while maintaining operational availability for Combatant Command and Defense Agency missions. Investigates endpoint alerts related to malware activity, suspicious behavior, and policy violations using centralized consoles, SIEM integrations, and forensic utilities. Coordinates containment, eradication, and recovery actions with system administrators, network defenders, and incident response teams in accordance with approved response procedures. Deploys endpoint security updates, agent upgrades, and signature releases while validating successful propagation and system health. Monitors endpoint compliance posture against configuration baselines, patch requirements, and IAVA directives, documenting results within continuous monitoring repositories. Produces endpoint security status reports, incident summaries, and compliance dashboards for cybersecurity leadership and Authorizing Officials using ServiceNow, SharePoint, and reporting platforms. Supports audits, inspections, and authorization activities through defensible evidence collection and traceability. Delivers measurable improvements in threat detection coverage, response timeliness, endpoint hygiene, and mission resilience while reinforcing program values of operational readiness, cyber discipline, accountability, and information protection. Performs other duties as assigned. Required Skills Current Secret security clearance. 12 or more years of progressively responsible experience in endpoint security, cybersecurity operations, or a closely related field, with demonstrated expert‑level proficiency managing large‑scale endpoint protection programs across enterprise or multi‑enclave DoW environments. DoW 8140/8570 IAM Level I baseline certification, satisfied by one of the following active credentials: CompTIA Security+ CE, ISC² CAP, ISC² SSCP, or GIAC GSLC. Hands‑on experience operating and administering endpoint protection platforms such as Host‑Based Security System (HBSS), Endpoint Detection and Response (EDR) tooling, and compliance monitoring agents across NIPRNet, SIPRNet, and JWICS environments, including policy configuration, agent lifecycle management, and compliance posture tracking. Demonstrated experience supporting continuous monitoring, POA&M management, SIEM integration, and cybersecurity authorization activities using platforms such as eMASS, ServiceNow, Splunk, or equivalent tools in a DoW or federal government environment. Strong problem‑solving and decision‑making capabilities, with a proven ability to weigh the relative costs and benefits of potential actions and identify the most appropriate solution. Highly developed interpersonal and oral/written communication skills, with the ability to effectively and professionally interact with a diverse set of stakeholders (from peers to end‑users to executive management). Desired Skills Active Top Secret (TS) security clearance with Sensitive Compartmented Information (SCI) eligibility. Active Certified Information Systems Security Professional (CISSP) certification, or an equivalent advanced credential such as CISM, GCIA, GCIH, or CEH; possession of a CISSP is specifically identified as a desired qualification for senior cybersecurity roles on this program. Prior experience supporting endpoint security operations on DoW, intelligence community, or defense programs operating across NIPRNet, SIPRNet, and JWICS, including familiarity with DISA STIGs, IAVA compliance workflows, and enclave‑specific endpoint hardening requirements. Familiarity with Security Orchestration, Automation, and Response (SOAR) platforms, Security Operations Center (SOC) monitoring workflows, and supply chain risk management practices applicable to endpoint software and hardware components. Bachelor's or Master's degree in Cybersecurity, Information Assurance, Computer Science, or a closely related technical field. ECS Federal LLC is an equal opportunity employer and does not discriminate or allow discrimination on the basis any characteristic protected by law. All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, or local jurisdiction law. #J-18808-Ljbffr ECS