> Markdown version of [/jobs/ext/2272925-endpoint-security-analyst-elastic-defend](https://www.wearedevelopers.com/jobs/ext/2272925-endpoint-security-analyst-elastic-defend). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Endpoint Security Analyst - Elastic Defend - **Company:** Leidos, Inc. - **Location:** Adelphi, MD, United States - **Experience:** Experienced - **Salary:** $107,900.0 - $195,050.0 - **Contract:** Permanent contract - **Skills:** Cyber Security, System Configuration, Intrusion Detection and Prevention, McAfee VirusScan, Performance Tuning, SAP (Applications), Mitre Att&ck, Cyber Threat Analysis, Tanium Platform Expertise, Cybercrime, Epic ECSA, Cyber Warfare - **Published:** August 27, 2026 - **Apply:** https://www.clearancejobs.com/jobs/9120486/endpoint-security-analyst-elastic-defend ## About the Role * Bachelor's degree in Science, Technology, Engineering, Mathematics (STEM), cybersecurity, or a related field and 4+ years of relevant cybersecurity experience. * Hands-on experience deploying, configuring, operating, or supporting enterprise endpoint security or EDR solutions. * Strong understanding of endpoint protection, security telemetry, threat detection, incident investigation, and response. * Experience investigating and responding to endpoint security alerts and potential compromises. * Knowledge of current cyber threats, attacker techniques, and defensive strategies, including familiarity with the MITRE ATT&CK framework. * Strong analytical, troubleshooting, and problem-solving skills. * Ability to work effectively across cybersecurity, threat, and engineering teams. * Strong written and verbal communication skills. * U.S. citizenship and an active TS/SCI with SAP eligibility. * At least one of the following certifications: + GIAC/SANS: GCIA, GCIH, GCFA, GCFE, GREM, GISF, GXPN, GWEB, GNFA, or GMON + Offensive Security: OSCP, OSCE, OSWP, or OSEE + ISC2: CCFP or CISSP + EC-Council: CEH, CHFI, LPT, ECSA, or ECI, * Hands-on experience with Elastic Agent and Elastic Defend, including deployment, configuration, policy management, tuning, and troubleshooting. * Experience optimizing endpoint telemetry and security controls in large-scale enterprise environments. * Experience developing or tuning endpoint detection rules, threat signatures, IOCs, and behavioral detections. * Experience using Elastic capabilities for endpoint investigation, advanced querying, forensic data collection, and response actions. * Experience with CrowdStrike Falcon, McAfee/Trellix ePO, Tanium, or similar enterprise endpoint security platforms. * Experience deploying and configuring CrowdStrike Falcon sensors and creating custom Indicators of Compromise (IOCs) and Indicators of Attack (IOAs). * Experience supporting endpoint security operations within large, complex, or mission-critical environments. * Relevant endpoint security certifications, such as Elastic, CrowdStrike, or Tanium certifications. ## Description You will work closely with threat, engineering, and cybersecurity operations teams to strengthen endpoint defenses, improve visibility, and rapidly identify and respond to emerging cyber threats., * Deploy, configure, operate, tune, upgrade, and troubleshoot Elastic Agent, Elastic Defend, and other enterprise endpoint security technologies. * Optimize endpoint protection and telemetry collection to maximize security visibility and detection effectiveness while minimizing operational and system performance impacts. * Partner with Threat and Detection teams to customize detection rules, develop threat signatures, and align endpoint defenses with emerging threat intelligence and MITRE ATT&CK techniques. * Conduct host-based defensive cyber operations to identify, investigate, contain, mitigate, and remediate vulnerabilities and intrusions. * Support cyber investigations using advanced endpoint queries, forensic data collection, and rapid containment and response capabilities. * Build and maintain queries, dashboards, and reports that provide enterprise security visibility and leadership awareness. * Coordinate with engineering teams on endpoint security deployments, patches, hot fixes, upgrades, and other critical security updates. * Troubleshoot endpoint security tool issues, performance concerns, and outages. * Develop and maintain endpoint security policies, configurations, and Standard Operating Procedures (SOPs). * Evaluate emerging endpoint security tools, techniques, and technologies and recommend improvements aligned with enterprise cybersecurity strategy. ## Related Videos - [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)