Microsoft Defender Security Lead

Essnova Solutions, Inc.; Bethesda (MD); Hybrid; USD 120,000 - 150,000; Full time

Job summary

Essnova Solutions, Inc. is hiring a Microsoft Defender Security Lead to drive enterprise endpoint-security delivery for NIH. You will oversee MDE/MDAV implementation, governance, and reporting across ~55,000 endpoints and 15,000+ servers.

The role requires 8+ years in endpoint security, hands-on Defender experience, and strong governance skills in a large, regulated environment. This is a full-time, hybrid role contingent on contract award.

Qualifications

• Bachelor’s degree in Cybersecurity, Information Assurance, CS, Engineering or related field.
• 8+ years of experience in endpoint security and/or cybersecurity engineering.
• 5+ years hands-on experience implementing or operating Defender technologies.
• Experience with MDE, MDAV, EDR, endpoint/server onboarding, and ASR.
• Ability to support large-scale, regulated environments (federal preferred).

Responsibilities

• Lead implementation, sustainment, optimization, governance, and reporting for MDE/MDAV.
• Oversee Cylance-to-Defender Antivirus migration and track endpoint populations.
• Govern approved ASR, Tamper Protection, device control, and Defender policies.
• Monitor MDE coverage, MDAV updates, policy posture, and exceptions.
• Coordinate with NIH SOC and security stakeholders on governance.

Skills

8+ years in endpoint security

5+ years hands-on Defender

MDE / MDAV expertise

EDR and policy governance

Threat and vulnerability management

Education

Bachelor's in Cybersecurity/CS/Engineering

Tools

Microsoft Defender for Endpoint

Microsoft Defender Antivirus

Endpoint security tooling

Job description

Location: Bethesda/Rockville, MD / Hybrid-Telework Eligible

Employment: Full-Time

Status: Contingent Upon Proposal Award

About Essnova

Essnova Solutions, Inc. is seeking an experienced Microsoft Defender Security Lead to lead enterprise endpoint-security delivery supporting a large-scale Microsoft endpoint management and cybersecurity modernization program for the National Institutes of Health (NIH).

This position is contingent upon Essnova receiving contract award.

The Microsoft Defender Security Lead will lead implementation, sustainment, optimization, migration, policy governance, coverage improvement, and remediation activities for Microsoft Defender for Endpoint (MDE) and Microsoft Defender Antivirus (MDAV) across an enterprise environment of approximately 55,000 endpoints and 15,000+ servers.

What You'll Do

• Lead enterprise Microsoft Defender for Endpoint (MDE) and Microsoft Defender Antivirus (MDAV) implementation, sustainment, optimization, governance, and operational reporting.
• Lead remaining Cylance-to-Microsoft Defender Antivirus migration activities and track migrated, excepted, blocked, and unresolved endpoint populations.
• Implement, maintain, troubleshoot, and govern approved Attack Surface Reduction (ASR), Tamper Protection, device control, endpoint-security, and Microsoft Defender policies.
• Monitor and report MDE sensor coverage, MDAV active protection, MDAV update currency, policy posture, unhealthy sensors, and approved exceptions.
• Drive coverage-gap remediation, endpoint and server onboarding, policy issue resolution, and exception remediation.
• Support Threat and Vulnerability Management (TVM), vulnerability remediation, telemetry validation, detection tuning, and enterprise security reporting.
• Support Microsoft Defender governance across in-scope endpoint and server populations and coordinate Microsoft Defender for Cloud alignment.
• Coordinate with the NIH Security Operations Center (SOC) and Government security stakeholders while maintaining appropriate boundaries between endpoint-security engineering, SOC operations, and server administration.
• Develop and maintain security governance artifacts, operational documentation, metrics, dashboards, reports, remediation evidence, and knowledge-transfer materials.
• Support security reviews, authorization/ATO activities, assessments, audits, incident readiness, compliance evidence, and security-control documentation.
• Support applicable federal cybersecurity and compliance requirements, including NIST, FISMA, HHS security/privacy requirements, and Section 508-compliant deliverables.
• Support transition of NIH endpoint-security capabilities from modernization and migration activities into steady-state enterprise operations.

• Bachelor’s degree in Cybersecurity, Information Assurance, Computer Science, Engineering, or a related technical field.
• 8+ years of experience in endpoint security and/or cybersecurity engineering.
• 5+ years of hands-on experience implementing or operating Microsoft Defender technologies.
• Demonstrated hands-on experience with:
• Microsoft Defender for Endpoint (MDE)
• Microsoft Defender Antivirus (MDAV)
• Endpoint Detection and Response (EDR)
• Endpoint and server onboarding
• Endpoint security policies and configuration
• Attack Surface Reduction (ASR)
• Security coverage monitoring and remediation
• Threat and vulnerability management
• Telemetry validation and detection tuning
• Exception governance and remediation tracking
• Enterprise security reporting
• Experience supporting large-scale enterprise endpoint and server populations in complex, regulated, and/or federal environments.
• Demonstrated experience executing or supporting antivirus and/or EDR migrations, including management of exceptions, blockers, continuity controls, and remediation.
• Experience producing technical and security evidence supporting authorization, assessment, audit, vulnerability management, incident readiness, and compliance activities.

Preferred Qualifications

• Experience supporting NIH, HHS, or another civilian federal health/science agency.
• Experience with Cylance-to-Microsoft Defender Antivirus migration or comparable third-party antivirus/EDR migration.
• Experience with Microsoft Defender for Cloud and MDE server governance.
• Experience with Microsoft Intune, Microsoft Entra, Azure, Azure Arc, or related Microsoft enterprise security and endpoint‑management technologies.
• Knowledge of NIST SP 800-53, NIST SP 800-171, FISMA, HHS security requirements, federal authorization/ATO processes, and audit requirements.
• Microsoft Certified: Cybersecurity Architect Expert, Security Operations Analyst Associate, or current equivalent Microsoft certification.
• CISSP, GIAC, Security+, or comparable cybersecurity certification.
• Demonstrated experience achieving measurable improvements in MDE sensor coverage, MDAV protection status, update currency, vulnerability remediation, security compliance, or exception closure.

Additional Requirements

Selected personnel must be willing and able to satisfy applicable post-award security, privacy, background investigation, training, rules-of-behavior, NDA, and Government system/access requirements. A signed Letter of Commitment will be required for proposed Key Personnel.

Contingency Notice

This position is contingent upon Essnova Solutions, Inc. receiving contract award and Government approval of proposed Key Personnel. Anticipated contract performance is expected to begin following award.

Equal Employment Opportunity

Essnova Solutions, Inc. is an Equal Opportunity Employer. We consider qualified applicants without regard to race, color, religion, sex, national origin, disability, protected veteran status, or any other status protected by applicable law.