nMicrosoft Endpoint Configuration Manager

The Digital Sector at Leidos is currently seeking a senior, hands-on \nMicrosoft Endpoint Configuration Manager (MECM) Subject Matter Expert and Team Lead to support DISA J-6/J-9 in the \nArlington, VA (Pentagon). This position leads enterprise MECM operations and a team of MECM administrators responsible for endpoint imaging, operating system deployment, application packaging, software update management, vulnerability remediation, configuration compliance, and MECM infrastructure sustainment.\n \n The selected candidate will use MECM as a primary enterprise tool to rapidly remediate vulnerabilities and configuration deficiencies across Windows endpoints in OSD forest, OMS, and Platform Management domains operating on NIPRNet, SIPRNet, TS-C, and JWICS networks. The role requires strong technical leadership, extensive hands-on MECM expertise, and the ability to coordinate closely with Cyber Compliance, DCO, infrastructure teams, and government stakeholders to meet DISA STIG, IAVM, CTO, FRAGO, and other cyber-tasking suspense requirements.\n \n \n2.Primary Responsibilities:\n \n Team Leadership and MECM Operations-\n \u2022 Lead the MECM team, including work assignment, technical oversight, mentoring, quality assurance, and escalation support for MECM Intermediate SMEs and System Administrators.\n \u2022 Serve as the authoritative technical point of contact for MECM operations, enterprise endpoint-management capabilities, and vulnerability-remediation execution.\n \u2022 Establish and maintain standard operating procedures, deployment standards, testing requirements, rollback plans, and change-control documentation for MECM services.\n \u2022 Coordinate with DISA J-6/J-9, Cyber Compliance/IA personnel, DCO, server, network, database, and application teams to resolve endpoint-management issues and execute enterprise remediation initiatives.\n \u2022 Brief MECM operational status, vulnerability-remediation progress, technical risks, and decisions required to DISA J-6/J-9 leadership and the Monthly Integrated Product Review (IPR).\n \n Vulnerability Remediation and Patch Management-\n \u2022 Own an aggressive vulnerability-remediation posture using MECM to package, test, deploy, validate, and report remediation for patches, hotfixes, cumulative updates, third-party software updates, configuration changes, and security baselines.\n \u2022 Drive remediation of DISA Security Technical Implementation Guide (STIG) findings, Information Assurance Vulnerability Management (IAVM) notices, Cyber Tasking Orders (CTOs), FRAGOs, and other cyber tasking within or ahead of established suspense dates.\n \u2022 Use MECM Software Update Management, compliance baselines, configuration items, PowerShell scripts, task sequences, and Group Policy changes to remediate vulnerabilities and configuration deficiencies.\n \u2022 Establish and maintain automated deployment rings, phased rollout strategies, pilot groups, maintenance windows, and emergency-patching procedures that balance remediation speed with operational stability.\n \u2022 Prioritize remediation based on vulnerability severity, exploitability, asset criticality, affected endpoint population, IAVM suspense, mission impact, and available compensating controls.\n \u2022 Correlate MECM deployment and compliance data with ACAS/Tenable scan results, Trellix endpoint-security data, and other cyber-tool outputs to identify remediation gaps and validate closure.\n \u2022 Support POA&M development and updates; provide technical evidence, deployment results, scan validation, and remediation artifacts for CCORI, inspections, audits, and cyber compliance reviews.\n \n Imaging and Operating System Deployment-\n \u2022 Design, develop, maintain, and troubleshoot MECM operating system deployment (OSD) capabilities for enterprise Windows endpoints.\n \u2022 Build and sustain task sequences for new system deployment, hardware refresh, operating system upgrades, break/fix replacement, reimaging, security-tool installation, domain join, baseline configuration, and post-build application deployment.\n \u2022 Manage and maintain operating system images, boot images, driver packages, driver-selection logic, PXE services, boot media, user-state migration processes, and supporting deployment content.\n \u2022 Develop automated endpoint-build processes that reduce technician touch time, improve deployment consistency, and ensure systems are configured to approved security and operational standards.\n \u2022 Troubleshoot OSD failures involving PXE, boot images, task sequences, driver injection, content availability, network connectivity, certificates, domain join, and post-build software installation.\n \u2022 Coordinate imaging and deployment support during hardware lifecycle refreshes, Windows version upgrades, and major enterprise technology transitions.\n \n Application Packaging and Software Deployment-\n \u2022 Package, test, deploy, and maintain enterprise applications using MECM application-management capabilities, MSI, EXE, PowerShell, scripts, and other approved installation methods.\n \u2022 Develop application detection methods, requirement rules, dependencies, relationships, return-code handling, uninstall procedures, and user-experience settings.\n \u2022 Maintain application deployment standards and packaging documentation to ensure consistent, reliable, and auditable software delivery.\n \u2022 Coordinate with application owners, cybersecurity personnel, and system stakeholders to deploy application upgrades, emergency patches, vulnerable-software removals, and security configuration changes.\n \u2022 Validate applications in pilot and phased-deployment rings before broad enterprise release; monitor deployments and rapidly address failures or unintended operational impacts.\n \u2022 Maintain software catalog accuracy, deployment content, and distribution-point availability to support timely enterprise application delivery.\n \n MECM Infrastructure and Platform Sustainment-\n \u2022 Administer, maintain, and modernize enterprise MECM infrastructure, including site servers, management points, distribution points, software update points, WSUS integration, SQL Server back-end components, reporting services, and associated Windows Server infrastructure.\n \u2022 Ensure MECM infrastructure remains healthy, secure, patched, backed up, recoverable, and capable of meeting Group 1 restoration timelines.\n \u2022 Monitor and troubleshoot MECM site health, component status, client communication, content distribution, replication, software update synchronization, database performance, certificate status, and endpoint-management service availability.\n \u2022 Lead root-cause analysis and service restoration for MECM outages and performance issues, including failures related to SQL Server, WSUS, site components, distribution points, boundary groups, PKI, Active Directory, Group Policy, and client communication.\n \u2022 Maintain MECM current branch releases, hotfixes, cumulative updates, management packs, supporting Windows Server updates, and required security configurations.\n \u2022 Manage MECM backup, recovery, and restoration processes, ensuring backups are retained and stored away from the physical system in accordance with applicable policy and continuity requirements.\n \u2022 Plan, coordinate, test, and execute MECM upgrades, server refreshes, distribution-point migrations, and infrastructure lifecycle activities through the DISA J-6/J-9 Enterprise Change Management framework.\n \n Automation, Reporting, and Compliance Metrics-\n \u2022 Develop and maintain PowerShell automation for patch deployment, vulnerability remediation, client-health correction, application deployment, inventory collection, reporting, and administrative tasks.\n \u2022 Create and sustain MECM task sequences, compliance baselines, configuration items, collections, queries, and deployment workflows that automate endpoint remediation at scale.\n \u2022 Produce weekly Microsoft Endpoint Operational Status and vulnerability-remediation metrics, including client health, software update compliance, deployment success rates, imaging status, application deployment status, and aging vulnerabilities.\n \u2022 Develop and maintain reports and dashboards using MECM reporting, SQL Server Reporting Services (SSRS), SQL queries, and/or Power BI.\n \u2022 Analyze remediation trends and recurring deployment failures; recommend process, automation, infrastructure, or policy improvements to improve compliance and reduce vulnerability aging\n \n

u2022 Bachelor’s degree in Computer Engineering, Computer Information Systems, Telecommunications, Management Information Systems, Cybersecurity, or a related field; 8 - 12 years of prior relevant experience or Masters with 6 - 10 years of prior relevant experience. Specific experience, education and training may be considered in lieu of degree.\n \u2022 U.S. Citizenship is a must.\n \u2022 Active Top Secret clearance or higher at time of consideration.\n \u2022 Must have a current DoD 8570.01-M / DoD 8140 IAT Level II baseline certification requirements before start date, such as Security+ CE, CCNA-Security, CySA+, GICSP, GSEC, or equivalent.\n \u2022 Computing Environment certification appropriate to the role, such as a current Microsoft endpoint-management or Windows Server certification, is required.\n \u2022 100% onsite at a government facility within the National Capital Region, primarily at the Pentagon, Crystal Gateway, Taylor Building, Mark Center, or another DISA J-6/J-9-designated alternate site.\n \u2022 Candidate must reside in the DC Metro Area and have reliable transportation.\n \u2022 Must comply with all DoD, DISA, and DISA J-6/J-9 security and access protocols, including the ability to access NIPRNet and SIPRNet environments.\n \u2022 Seven (7) or more years of hands-on experience administering MECM/SCCM at enterprise scale, including experience serving as a senior technical authority, technical lead, or team lead.\n \u2022 Demonstrated experience leading or mentoring systems administrators, endpoint-management personnel, or technical teams.\n \u2022 Demonstrated experience using MECM to execute vulnerability remediation and improve patch compliance against DoW STIGs, IAVMs, DTOs, FRAGOs, or comparable cyber tasking within mandated timelines.\n \u2022 Expert-level knowledge of MECM software update management, application packaging, application deployment, OS deployment/imaging, task sequences, compliance baselines, client health, and endpoint troubleshooting.\n \u2022 Hands-on experience building and supporting MECM operating system deployment solutions, including task sequences, boot images, driver packages, PXE, and endpoint provisioning workflows.\n \u2022 Hands-on experience packaging and deploying enterprise applications, including detection methods, dependencies, supersede, installation scripting, and deployment troubleshooting.\n \u2022 Strong experience administering MECM infrastructure, including site servers, management points, distribution points, software update points/WSUS, SQL Server, SSRS, Active Directory, Group Policy, Windows Server, and PKI.\n \u2022 Strong PowerShell scripting skills for automation of endpoint remediation, software deployment, reporting, and administrative operations.\n \u2022 Experience producing and interpreting MECM operational reporting through SSRS, SQL Server, Power BI, or equivalent reporting tools.\n \u2022 Experience integrating or correlating MECM data with cyber tools, including ACAS/Tenable and Trellix EDR or equivalent vulnerability-management and endpoint-security platforms.\n \u2022 Working knowledge of RMF, POA&M management, CCORI/inspection readiness, and DoD cyber tasking processes.\n \u2022 Excellent troubleshooting, written communication, verbal communication, leadership, and customer-briefing skills.\n \n \n4.Preferred Qualifications:\n \u2022 Experience with WSUS/SUP architecture, Automated Deployment Rules (ADRs), patch compliance, deployment rings and troubleshooting failed updates.\n \u2022 Working knowledge of Microsoft SQL Server, MECM databases, queries, WQL/CMPivot, and reporting technologies such as SSRS.\n \u2022 Experience troubleshooting MECM using client/server logs, CMTrace, WMI, registry, PowerShell and network troubleshooting tools.\n \u2022 Experience with Microsoft Intune, Entra ID and MECM/Intune co-management is highly desirable. Microsoft supports moving workloads such as compliance, Windows Update, endpoint protection, device configuration and client applications between Configuration Manager and Intune.\n

If you’re looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo - because the mission demands it. We’re not hiring followers. We’re recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We’re already at step 30 - and moving faster than anyone else dares.