Systems Engineer

2.3 Scope of Work for IT Help Desk Support


The Contractor employees shall provide direct support by managing requests through the help desk


ticketing system, troubleshooting the most sophisticated hardware and software issues, and providing


guidance to less experienced specialists within the team. The Contractor employees will also provide on-


call daily office support and assist with conference room technology support. They may work on IT


projects in addition to the help desk function under certain circumstances. To clarify scope and set


accurate expectations, duties are organized into three functional categories:



D aily - Primary day-to-day responsibilities performed consistently throughout the performance


period.



Project - Periodic tasks tied to specific initiatives, upgrades, or improvement efforts.



Engineering/Periodic - Advanced or strategic functions performed on an as-needed basis; not


intended to represent the primary daily workload of Tier II Specialists.



2.3.1 Daily Tasks


The Contractor employees shall perform the tasks listed below consistent with instructions and guidance


provided by the Contracting Officer's Representative (COR):
• Inspect computer equipment and prepare systems for deployment based on onboarding


documentation and division-specific requirements, ensuring proper imaging, configuration, and


inventory registration prior to delivery.
• Deploy and configure Windows desktops, macOS systems, and mobile devices following the


imaging process, ensuring each device is properly inventoried, validated against security


baselines, and ready for end-user delivery in accordance with division-specific requirements and


IRM standards. Solicitation No. CB26-RFQ0011 - IT Help Desk Support Services



Page 9 of 19



GSA Contract No. TBD
• Install, configure, troubleshoot, and maintain employee hardware, software, and peripheral


components across Windows and macOS environments, including upgrades, patches, firmware


updates, and approved security configurations to maintain compliance with Zero Trust and


Defense-in-Depth standards.
• Register and configure mobile devices (iOS, Android) within enterprise mobile device


management (MDM) platforms; provide users with training and troubleshooting on


authentication, MFA, and secure remote connectivity.
• Load and verify software packages and configuration baselines through automated imaging and


patching tools such as Ivanti EPM, KACE, or equivalent, ensuring accuracy and adherence to


approved division templates.
• Execute system verification tests by entering administrative commands and monitoring log output


to validate image integrity, patch levels, and compliance with endpoint security policies; confirm


logs are being received in accordance with guidance from Sentinel, VSOC, and other monitoring


platforms.
• Diagnose and resolve complex system issues, including multi-factor authentication failures,


identity anomalies, network connectivity problems, and endpoint irregularities, applying


independent judgment to identify root causes and implement corrective actions while protecting


sensitive data.
• Support Tier I personnel by enforcing best practices, creating and validating SOPs, reviewing


escalations, and collaborating on issue resolution. Leverage JAMF and Microsoft Intune for


endpoint automation and configuration management. Apply system administration expertise to


analyze Windows Event Viewer and macOS Console logs, identify error patterns, and develop


evidence-based solutions to prevent recurrence.
• Instruct users on the effective use of equipment, collaboration software, cloud services, and self-


service resources; contribute to end-user documentation and knowledge base updates.
• Coordinate activities with the Service Desk, Network Operations, Cloud Services, and


Cybersecurity teams to ensure timely issue resolution and alignment with IRM standards.
• Provide clear and timely communication on ticket status, updates, and resolutions through the


official tracking system, voicemail, email, or direct user interaction in accordance with customer


service performance metrics.
• Replace defective or obsolete hardware and software components, document all changes, and


verify asset records in accordance with CBO asset management procedures.
• Identify and analyze recurring problem trends, develop mitigation strategies, and present findings


and improvement recommendations to IRM management.
• Ensure rigorous application of information security and information assurance principles in all


aspects of customer support, including encryption, data loss prevention, and secure credential


handling.
• Administer Microsoft Entra ID / Active Directory environments, including user account


provisioning, group policy adjustments, and identity lifecycle management, in coordination with


IAM governance.
• Support macOS and iOS administration, including device enrollment, configuration profile


deployment, FileVault management, and integration with enterprise authentication and


compliance frameworks.
• Perform secure drive sanitization and destruction using BitRaser or other approved tools,


maintaining required documentation and certificates of destruction. Solicitation No. CB26-RFQ0011 - IT Help Desk Support Services



Page 10 of 19



GSA Contract No. TBD
• Use approved hard drive cloning devices and software to support workstation deployments,


refreshes, data migrations, and recovery operations.



2.3.2 Periodic Project and Engineering Tasks


The Contractor employees shall periodically perform the project and engineering tasks listed below,


consistent with instructions and guidance provided by the COR:
• Recommend and implement advanced remedial measures - such as driver updates, policy


adjustments, or imaging corrections - to restore full functionality and prevent recurrence.


Coordinate reviews with the Chief Information Officer (CIO) / Deputy Chief Information Officer


(DCIO) and automate solutions where feasible.
• Implement and document imaging strategies that leverage automation, scripting, and division-


specific baselines to deliver secure, consistent workstation builds across all platforms.
• Participate in patch management and vulnerability remediation cycles, ensuring timely updates


and adherence to established configuration management policies; coordinate with Nessus scan


findings to prioritize remediation of critical and high-severity vulnerabilities.
• Collaborate with IRM technical leads (Cloud, Engineering, and Development teams) to assess


environment readiness, validate permissions, and confirm that personnel maintain appropriate


administrative access for Tier II and escalation functions.
• Assist in responding to outages, service disruptions, and other emergencies, including


participation in incident response activities.



2.4 Personnel Requirements


The Contractor employees performing the work under this contract must possess the following


knowledge, skills, and abilities:
• Must be able to provide enterprise-level administration and support for macOS and Windows


operating systems, including imaging, deployment, configuration management, and adherence to


organizational security baselines.
• Experience utilizing and supporting endpoint management and automation platforms such as


Ivanti, KACE, Microsoft Intune, and JAMF to deploy software, manage devices, enforce policies,


and streamline routine tasks.
• The ability to manage and troubleshoot identity and access management services, including


Microsoft Entra ID/Active Directory, multi-factor authentication (MFA), role-based access


controls, and AWS-integrated identity solutions.
• The ability to diagnose and resolve authentication, connectivity, and endpoint performance issues


by analyzing system logs, Event Viewer data, macOS Console diagnostics, and other relevant


monitoring tools.
• The ability to coordinate cross-team incident response activities by working closely with the


Service Desk, Network Operations, and Cybersecurity teams to ensure timely investigation,


escalation, and remediation of technical issues.
• A strong understanding of advanced system administration including patch management, baseline


configuration, automated imaging processes, and the ability to troubleshoot and improve endpoint


deployment workflows.
• A strong understanding of cloud and hybrid environment management, with specific experience


supporting AWS-hosted resources, identity services, and integrations between on-premises and


cloud-based infrastructures.
• A strong understanding of Zero Trust security principles, ensuring all endpoint, user, and network


interactions follow the organization's security, compliance, and configuration standards. Solicitation No. CB26-RFQ0011 - IT Help Desk Support Services



Page 11 of 19



GSA Contract No. TBD
• Clear and effective communication, including the ability to document technical procedures, create


user-friendly guides, and mentor Level I technicians to enhance overall Service Desk capability.
• Must have excellent customer service and problem-solving skills and the ability to prioritize tasks


to meet tight deadlines while maintaining professionalism and responsiveness.



Preferred Certifications


o CompTIA Security+


o Microsoft Certified: Endpoint Administrator Associate (or equivalent)


o Apple Certified IT Professional


o AWS Certified Cloud Practitioner (or higher-level AWS certification)


o ITIL Foundation or equivalent certification in service management


o Certified SysOps Administrator - Associate



Preferred Education


Bachelor's degree in information technology, Computer Science, or a closely related field.



2.5 Security Requirements


The Contractor employees must be U.S. citizens, or lawful permanent residents or H1Bs if they are able


to meet all other criteria, including work eligibility. The Contractor employee shall obtain favorable FBI


criminal checks and be fingerprinted at the U.S. Capitol Police headquarters in Washington, DC prior to


starting work under the contract. The Contractor employee may need to complete additional training as


required by CBO to meet cybersecurity, computer access, and content management requirements. The


Contractor shall maintain the confidentiality of all agency information (see clause CBO 239-01, Security


for Confidential Information).



2.6 Key Personnel Requirements


See clause CBO 237-70, Key Personnel, for the specific designated role(s).



2.7 Place of Performance


Work will primarily be performed on-site at the following location:


Congressional Budget Office


Ford House Office Building, 4th Floor


2nd and D Streets SW


Washington, DC 20515


Work may occasionally be performed at the following CBO facilities, as directed by the COR:


Alternate Computing Facility (ACF)


9050 Wellington Road


Manassas, VA 20109


Equinix, Inc. (EQX)


21711 Filigree Court


Ashburn VA 20147


The Ford House Office Building is across the street from the Federal Center SW metro station,