Mid-Level Cybersecurity Engineer

drawbridge; McLean (VA); Hybrid; USD 135,000 - 165,000; Full time

Benefits offered by this job

Health benefits

Paid time off

Certification reimbursement

Program stability

Job summary

Drawbridge Recruiting is seeking a Mid-Level Cybersecurity Engineer to own the Carbon Black endpoint security platform and DLP controls for a government program. This hands-on role requires TS/SCI with CI Polygraph and a hybrid schedule between Gaithersburg, MD and Tysons Corner, VA, with on-site requirements in a secure facility.

You will deploy, tune and enforce security controls, engage with SOC/IR teams, and contribute to RMF/ATO activities while supporting continuous improvement of endpoint

Qualifications

• Active TS/SCI with CI Polygraph at hire time.
• 4–7 years IT or cybersecurity experience.
• 2+ years hands-on Carbon Black administration.
• Experience designing DLP and device control policies.
• Windows and Linux endpoints, Active Directory, Group Policy.
• DoD 8140/8570 IAT Level II certification or ability to obtain within 6 months.
• Bachelor's degree in IT/Cybersecurity or related field, or equivalent experience.

Responsibilities

• Administer, configure and tune Carbon Black across Windows and Linux endpoints.
• Build and enforce DLP policies to stop data exfiltration.
• Create and maintain app allow-listing and device control rules.
• Monitor, triage and investigate endpoint alerts and data exfiltration events.
• Partner with SOC, Insider Threat and Incident Response teams.
• Handle Carbon Black upgrades, patching, and sensor deployment.
• Support RMF/ATO activities with documentation and evidence.
• Produce reports on endpoint posture and data protection trends.
• Maintain SOPs, configuration baselines and technical docs.

Skills

TS/SCI with CI Polygraph

Experience: 4–7 years

Carbon Black administration

DLP and device control policies

Windows and Linux endpoints

NIST RMF/DoD security

IAT Level II cert (DoD 8140/8570)

Bachelor's or equivalent in IT/Cyber

Education

Bachelor's degree in IT/Cybersecurity or related field

Tools

Carbon Black

Job description

Mid-Level Cybersecurity Engineer – Carbon Black / DLP
Active TS/SCI with CI Polygraph Required

Location: Gaithersburg, MD or Tysons Corner, VA (Hybrid)
Clearance: Active TS/SCI with Counterintelligence (CI) Polygraph
Employment Type: Full-time, Direct Hire
Compensation: $150,000 + benefits

About the Role

Drawbridge Recruiting is partnering with a leading national security contractor to hire a Mid-Level Cybersecurity Engineer for a mission-critical government program. You'll own the Carbon Black endpoint security platform and the data loss prevention (DLP) controls that keep sensitive and classified information where it belongs.

This is a hands-on engineering role. You'll deploy, configure and tune the tools, write the policies, investigate what gets flagged, and work alongside the SOC, Insider Threat and Incident Response teams. You'll split your time between a hybrid schedule and a secure facility in Gaithersburg or Tysons Corner.

What You'll Do

• Administer, configure and tune Carbon Black (EDR, App Control and Device Control) across enterprise Windows and Linux endpoints
• Build and enforce DLP policies that stop unauthorized transfer of sensitive or classified data through removable media, applications and network channels
• Create and maintain application allow-listing and device control rules that protect the environment without slowing the mission
• Monitor, triage and investigate endpoint alerts and data exfiltration events, and escal…
• Partner with SOC, Insider Threat and Incident Response teams on investigations and remediation
• Handle Carbon Black upgrades, patching, sensor deployment and platform health monitoring
• Support RMF/ATO activities, including security control documentation, POA&Ms and audit evidence
• Produce reports and metrics on endpoint posture, policy violations and data protection trends
• Maintain SOPs, configuration baselines and technical documentation

What You'll Bring

• Active TS/SCI with CI Polygraph (must be current at time of hire)
• 4–7 years of IT or cybersecurity experience
• At least 2 years of hands-on Carbon Black administration (EDR/Response, App Control/Protection/Bit9, or Device Control)
• Experience designing and enforcing DLP and device control policies in an enterprise environment
• Working knowledge of Windows and Linux endpoints, Active Directory and Group Policy
• Familiarity with NIST 800-53, RMF and DoD/IC security requirements
• DoD 8140/8570 IAT Level II certification (such as Security+ CE), or the ability to obtain it within 6 months of hire
• Bachelor's degree in IT, Cybersecurity or a related field, or equivalent experience

Nice to Have

• Experience with other DLP platforms such as Forcepoint, Symantec/Broadcom DLP, Microsoft Purview or Trellix
• SIEM experience (Splunk, Elastic or ArcSight), including building correlation searches for endpoint and DLP events
• PowerShell or Python scripting for automation
• Certifications such as CySA+, CASP+, GCIH or CISSP
• Experience supporting Intelligence Community or insider threat programs

Work Schedule

Hybrid, with on-site days set by program needs. Classified work must be done on-site in a SCIF.

Why This Role

• Competitive salary and comprehensive benefits (medical, dental, vision, 401(k))
• Paid time off and federal holidays
• Training and certification reimbursement
• Long-term program stability supporting the national security mission