Cyber Intel Analyst / Penetration Tester

ENSCO, Inc.; Colorado Springs (CO); On-site; USD 85,000 - 115,000; Full time

Job summary

ENSCO, Inc. is seeking an on-site Cyber Intel Analyst / Penetration Tester to support Defensive Cyberspace Operations for Space (DCO-S) capabilities protecting critical U.S. Space Force mission systems.

The Cyber Detection Engineer will evaluate sensor visibility, analyze telemetry, map MITRE ATT&CK techniques, and develop threat-informed visuals. Travel up to 10% to CONUS/OCONUS locations may be required.

Qualifications

• Bachelor’s degree in cybersecurity, computer science, information technology, engineering, data science, or a related field; 3+ years of relevant experience.
• Experience in detection engineering, threat hunting, incident response, network defense, security analytics, or SOC operations.
• Experience applying MITRE ATT&CK to adversary TTPs and telemetry.
• Experience analyzing endpoint, network, system, or security-event data with SIEM/EDR/NSM.
• Ability to develop and refine detection logic, queries, scripts, visualizations, and repeatable processes.

Responsibilities

• Analyze endpoint, network, system, and security-event telemetry to identify detection opportunities and visibility gaps.
• Map mission threats, telemetry, and detections to MITRE ATT&CK.
• Develop and maintain ATT&CK Navigator layers, detection-coverage heatmaps, and visualizations.
• Assess coverage for techniques and classify as fully covered, partially covered, unobserved, or unassessed.
• Develop, test, and automate detection logic, queries, scripts, and repeatable analytical processes.
• Evaluate and validate security data from sensors through parsing, normalization, enrichment, indexing, and visualization.
• Translate findings into operator guidance and recommended searches and data sources.
• Support purple-team and threat-emulation activities and document gaps and risks for leadership.
• Collaborate with cyber operators, threat analysts, system admins, and mission stakeholders to improve methods.

Skills

Threat hunting

Incident response

Detection engineering

MITRE ATT&CK

Telemetry analysis

Log-source validation

Analytical skills

Communication

Collaboration

Education

Bachelor's degree in cybersecurity, computer science, information technology, engineering, data science, or related field

Tools

SIEM

EDR

Network security monitoring

Job description

For more than 50 years, ENSCO has been providing leading-edge engineering, science and advanced technology solutions to governments and private industries worldwide.

ENSCO prides itself in creating and applying advanced technologies for mission success. We provide systems engineering, integration, and advanced technology services to transform the future safety, security, and resiliency of critical missions on the ground, in the air, in space, and in the information systems that connect these domains.

ENSCO, Inc. is seeking an on-site Cyber Intel Analyst / Penetration Tester to support Defensive Cyberspace Operations for Space (DCO-S) capabilities protecting critical U.S. Space Force mission systems.

The Cyber Detection Engineer will evaluate whether cybersecurity sensors, data pipelines, and analytic platforms provide sufficient visibility into adversary activity. The position analyzes endpoint, network, system, and security-event telemetry; maps observable activity to adversary tactics, techniques, and procedures (TTPs); and develops threat-informed products that communicate detection coverage and operational risk.

The successful candidate will collaborate across cybersecurity operations, threat analysis, systems administration, data engineering, and mission-system organizations to translate complex technical findings into actionable guidance.

This position is on-site in Colorado Springs, Colorado.

Responsibilities

Analyze endpoint, network, system, and security-event telemetry to identify detection opportunities and visibility gaps within DCO-S platforms.

Map mission-relevant threats, telemetry, and detections to MITRE ATT&CK.

Develop and maintain ATT&CK Navigator layers, detection-coverage heatmaps, and related threat-informed visualizations.

Assess adversary TTP coverage and classify techniques as fully covered, partially covered, unobserved, or unassessed.

Develop, test, document, tune, and automate detection logic, queries, scripts, and repeatable analytical processes.

Evaluate and validate security data from sensor collection through parsing, normalization, enrichment, ingestion, indexing, storage, search, and visualization.

Translate findings into operator guidance, including recommended searches, analytical methods, and relevant data sources.

Support purple-team and threat-emulation activities by determining whether simulated adversary actions produce the expected telemetry and detections.

Document detection gaps, mission risks, and corrective actions for technical and leadership audiences.

Collaborate with cyber operators, intelligence analysts, system administrators, network engineers, quality-control personnel, and mission stakeholders to improve detection methodologies and test procedures.

Travel up to 10% to CONUS and OCONUS locations at the direction of the government customer.

Qualifications Required:

Bachelor’s degree in cybersecurity, computer science, information technology, engineering, data science, or a related field, plus three or more years of relevant experience. Equivalent education, military training, certifications, and professional experience will be considered.

Experience in detection engineering, threat hunting, incident response, network defense, security analytics, or SOC operations. Qualifying SOC experience must include functions such as hands‑on investigation, SIEM querying, detection tuning, threat hunting, telemetry analysis, or log‑source validation.

Experience applying MITRE ATT&CK to adversary TTPs, telemetry, detection logic, and coverage‑gap analysis.

Experience analyzing endpoint, network, system, or security‑event data using SIEM, EDR, network‑security‑monitoring, or comparable analytics platforms.

Ability to develop and refine detection logic, queries, scripts, visualizations, and repeatable analytical processes.

Ability to evaluate whether security data is properly collected, parsed, normalized, enriched, indexed, searchable, and available to cyber operators.

Strong analytical, problem‑solving, organizational, communication, and collaboration skills.

Ability to document and present complex technical findings to operator, engineering, mission, and leadership audiences.

Proficiency with Microsoft Word, Excel, and PowerPoint.

Must meet DoD 8140 qualification requirements for the assigned DCWF work role and proficiency level through an approved certification.

Active DoD Top Secret security clearance with SCI eligibility and U.S. citizenship required.

Qualifications Desired:

Experience supporting DoD, USSF, DCO-S, intelligence‑community, or other mission‑system environments.

Experience with ATT&CK Navigator, purple‑team exercises, adversary emulation, detection‑as‑code, or Sigma.

Experience with Bash scripting.

Current Security+, CySA+, or other certification approved for the assigned DCWF work role and proficiency level.

Required Certifications:

Required Certifications: See Required Skills

U.S. Citizenship Required: Yes

Security Clearance Required: TS/SCI

Employment Type: Regular Full-time

Background Check Type: 7 Year Pre‑Employment

Drug Screen Required: None

Position Contingent Upon Contract Award: No

Salary Range

$85,000 - $115,000 USD

REAL ID Requirement

This position may require the ability to access to U.S. federal facilities. In accordance with the Department of Homeland Security’s enforcement of the REAL ID Act, as of May 7, 2025, individuals must present a REAL ID‑compliant form of identification or an acceptable alternative to gain entry. For a list of acceptable forms of identification, please click here .

Export Control and Licensing

This position may involve access to technology or technical data that is controlled under U.S. export control laws and regulations and the release of which to a non US person may require an export license from the U.S. Government.

ENSCO, Inc. and its wholly owned U.S. subsidiaries are Equal Opportunity Employers– veterans, disability

Voluntary Self-Identificationof Veteran Status

For government reporting purposes, we ask candidates to respond to the below self‑identification survey. Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiring process or thereafter. Any information that you do provide will be recorded and maintained in a confidential file.

As set forth in ENSCO, Inc.’s Equal Employment Opportunity policy, we do not discriminate on the basis of any protected group status under any applicable law.

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection. As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measure the effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categories is as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service‑connected disability.

A "recently separated veteran" means any veteran during the three‑year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.