Evolver Federal is seeking a skilled and experienced User Activity Monitoring (UAM) Policy Engineer to support a federal agency in Landover, MD.. The Engineer will be responsible for the development, implementation, and administration of Insider Threat trigger policies. The UAM Policy Engineer will collaborate with Insider Threat analysts and various stakeholders to ensure optimal performance of threat detection capabilities. Additionally, the UAM Policy Engineer will conduct efficiency assessments, streamline alert trigger policies, and support ongoing investigations to identify and mitigate Insider Threats.

Responsibilities Include:

• Develop Insider Threat trigger policies using Forcepoint UAM expertise. This includes creating policies from code to implementation and ensuring they do not negatively impact existing support infrastructure, endpoints, and network.
• Analyze the effectiveness of UAM trigger policies and perform trend analysis to identify areas of improvement and enhance threat detection capabilities.
• Collaborate with Insider Threat analysts and stakeholder offices to gather requirements and ensure that trigger policies align with operational needs and security objectives.
• Support ongoing investigations on persons of interest, identifying data sources or unique source and methods for evidence gathering related to Insider Threats.
• Perform efficiency and gap assessments of trigger policy inventory, eliminating redundancy and streamlining alert trigger policies to gain network and storage efficiencies.
• Develop and test new trigger policies within tight timelines to meet emerging security challenges.
• Possess extensive scripting experience to develop effective trigger policies.
• Collaborate with USG personnel and stakeholders from multi-disciplinary offices to develop and document an enhanced trigger policy process for testing and implementation.
• Work within the confines and authorities of the DIA Information Technology infrastructure (CID) to test the delivery of agents/trigger policies to server-based infrastructure, expanding endpoint scope to target privileged users engaged in unauthorized activities.
• Maintain certifications in ForcePoint policy writing, Network Engineering, Microsoft Desktop Administrator, or equivalent qualifications to demonstrate technical expertise in UAM development and administration.

Minimum Qualifications and Requirements

Basic Qualifications:

• Must be a U.S. citizen with active DoD Top Secret/SCI clearance
• Must be willing and able to obtain SCI access and a Counterintelligence (CI) Polygraph prior to starting..
• Must possess current DoD 8570 IAT Level II certification which includes: Security CE, CCNA Security, CySA , GICSP, GSEC, CND or SSCP.
• Bachelor's degree in Computer Science, Information Technology, or a related field, or equivalent work experience.
• Minimum of 3 years of demonstrated experience in UAM endpoint policy development for classified and unclassified networks or deployment, configuration, support, and maintenance of classified and unclassified endpoints and operating systems.
• Extensive experience with Forcepoint UAM and expertise in developing Insider Threat trigger policies.
• Proven ability to translate written requirements into configurations for deployment to Host-based UAM capabilities and/or security client software
• Strong scripting skills to create effective trigger policies.
• Strong analytical and problem-solving skills with the ability to assess the impact of trigger policies on enterprise infrastructure and services.
• Excellent communication and collaboration skills to work effectively with stakeholders and team members.
• Ability to obtain certifications in ForcePoint policy writing, extensive scripting experience, and Network Engineering, Microsoft Desktop Administrator, or equivalent certifications

Preferred Qualifications:

• Active DoD TS/SCI with CI Polygraph is strongly preferred.