Junior Endpoint Engineer

Paycom; Bethesda, Northern (MD, KY); Hybrid; USD 70,000 - 85,000; Full time

Job summary

Paycom in Bethesda, MD is hiring a Junior Endpoint Engineer to support a cybersecurity modernization effort. You will assist senior engineers in migrating endpoints to Microsoft Defender for Endpoint and manage deployment waves in a hybrid onsite role.

The position requires a DoD Secret clearance, 1–3 years of IT/endpoint experience, and familiarity with MECM/SCCM, BitLocker, and FileVault. Candidates should have MD-102/SC-900 or equivalent certifications.

Qualifications

• Active DoD Secret clearance required.
• 1–3 years in IT support, systems administration, or endpoint management.
• Familiarity with MECM/SCCM deployment tools.
• Experience across Windows, macOS, and Linux administration.
• Knowledge of BitLocker and FileVault encryption.
• Certifications: IAM level, MD-102/SC-900, A+/Network+ or OS certs.

Responsibilities

• Assist in rolling out the MDE agent across Windows, macOS, Linux via MECM/SCCM and scripts.
• Monitor Defender portal during deployment waves for telemetry and success.
• Uninstall legacy Trellix agents after MDE verification.
• Support transition of disk encryption to BitLocker and FileVault.
• Escrow recovery keys in Entra ID and verify access protection.
• Contribute to STIG compliance reviews at agent level.
• Document blockers or conflicts for escalation by senior staff.

Skills

Active DoD Secret clearance

1–3 years IT/endpoint experience

Windows/macOS/Linux administration

BitLocker & FileVault knowledge

Documentation & compliance

Education

DoD 8570 IAM Level I or IAT II certification

MD-102 or SC-900 Microsoft certifications

CompTIA A+/Network+ or OS-specific certs

Tools

MECM/SCCM

Microsoft Defender for Endpoint (MDE)

Entra ID

Job description

# Junior Endpoint EngineerHybrid • Bethesda, MD 20814## OverviewSalary Range$70,000.00 - $85,000.00 Salary/yearPosition TypeFull TimeTravel PercentageNone## DescriptionTIAG is now hiring a **Junior Endpoint Engineer** to support a major cybersecurity modernization effort for the Uniformed Services University (USU). This role reports onsite in a Hybrid capacity at the customer location in Bethesda, MD. This position requires a Secret level clearance to be processed in order to begin work, so US or Naturalized Citizenship is a requierment.In this role the candidate will assist the Lead Security Architect and senior engineers in migrating approximately 3,000 heterogeneous endpoints (Windows, macOS, and Linux) from a legacy Trellix environment to Microsoft Defender for Endpoint (MDE).Key Responsibilities* Assist in executing high-velocity rollouts of the MDE agent to Windows, macOS, and Linux systems using Microsoft Endpoint Configuration Manager (MECM/SCCM) and automated deployment scripts.* Monitor the Microsoft Defender portal during deployment waves to verify that endpoints are establishing active, error-free telemetry reporting. Track failed deployments and retry statuses.* Assist in systematically uninstalling legacy Trellix agents across all supported operating systems once MDE telemetry is verified.* Support the transition of disk encryption management from Trellix to native OS tools, specifically BitLocker for Windows and FileVault for macOS.* Help verify that all native encryption recovery keys are successfully escrowed and protected within Entra ID to prevent any loss of access.* Support manual reviews and compliance checks to ensure applied DISA Security Technical Implementation Guides (STIGs) are correctly functioning at the agent level.* Document device-specific blockers and agent conflicts that require further troubleshooting by senior engineers or Government IT staff.## QualificationsRequired Experience:* Active DoD Secret clearance.* 1–3 years of hands-on experience in IT support, systems administration, or endpoint management.* Familiarity with enterprise deployment tools such as MECM/SCCM.* Basic administrative knowledge across multiple operating systems, including Windows, macOS, and Linux.* Understanding of disk encryption tools like BitLocker and FileVault.* DoD 8570.01-M Information Assurance Management (IAM) Level I or Information Assurance Technical (IAT) Level II certification (e.g., CompTIA Security+ CE).* Microsoft 365 Certified: Endpoint Administrator Associate (MD-102) or foundational Microsoft certifications (e.g., SC-900).* CompTIA A+, Network+, or basic OS-specific certifications (Windows/macOS).