Responsibilities
This position will support our newly awarded DCSA contract.
Description
Empower AI is seeking a Patch Management Engineer to own the analysis, prioritization, and enterprise deployment of operating system and third-party security patches for thousands of endpoints supporting a Department of War agency across Pre-Production, NIPRNet, SIPRNet, and JWICS enclaves. The engineer translates ACAS scan results, vendor advisories, USCYBERCOM/JFHQ-DODIN orders, and IAVMs into CAT I/II/III remediation plans; engineers and validates patch deployments through MECM/SCCM in strict adherence to PRS timeframes and compliance AQLs; analyzes non-compliant endpoints to root cause; and produces the patch compliance evidence that feeds the weekly Vulnerability Scan Analysis Report, the POA&M in eMASS, and the Customer Support Metrics Dashboard.
This is a salaried, FLSA-exempt position in which you will independently analyze situations, determine the appropriate course of action, and exercise discretion and independent judgment on matters of significance to the program and its customers.
THIS IS AN ONSITE ROLE IN QUANTICO, VA (RKB) WITH UP TO 10% OF TRAVEL INVOLVED.
Job duties
- Analyze weekly ACAS/Nessus scan results, vendor advisories, IAVMs, and USCYBERCOM/JFHQ-DODIN orders to determine applicability, assign CAT I/II/III categorization, and build prioritized remediation plans that meet PRS timeframes.
- Engineer, test (pre-production and Digital Twin), and deploy OS and third-party patches through MECM/SCCM and Intune, analyze deployment and compliance results, and drive remediation of non-compliant endpoints to root cause.
- Produce patch compliance reporting and evidence for the weekly Vulnerability Scan Analysis Report, POA&M items in eMASS, and the Customer Support Metrics Dashboard, and coordinate exceptions and mitigations with the ISSO and RMF team.
- Maintain the patch management process, maintenance-window schedules, and Change Management packages, and recommend automation to shorten time-to-remediate.
- Analyze weekly ACAS/Nessus vulnerability scan results for all in-scope systems, identify and prioritize critical and high (CAT I/II/III) vulnerabilities, assign remediation to resolver groups, validate fixes, and produce the weekly Vulnerability Scan Analysis Report.
- Assess STIG compliance for endpoints, servers, printers, communications equipment, and platforms using STIG Viewer, SCAP, and endpoint management compliance data; track deviations and remediation; and produce the monthly STIG Compliance Report.
- Maintain and update POA&M items in eMASS for assigned systems, including milestones, mitigations, risk statements, and evidence of closure, in coordination with ISSOs and system administrators.
- Monitor the endpoint environment's security compliance status (patch compliance, baseline compliance, time-to-remediate) and ensure accurate cybersecurity metrics are fed to the Customer Support Metrics Dashboard.