Cyber Intel Analyst / Penetration Tester
On-site cyber analyst/penetration tester in Colorado Springs supporting U.S. Space Force defensive cyberspace operations (DCO-S). Day to day, analyze endpoint, network, and security-event telemetry, map detections to MITRE ATT&CK, and build/tune detection logic in SIEM/EDR platforms while reporting coverage gaps to technical and leadership audiences.
- Compensation
- $85K–$115K / yr
- Location
- Colorado Springs, Colorado, United States
- Work setup
- Not specified
- Seniority
- Not specified
- Employment
- Contract
- Experience
- 7+ years
- Category
- Security
- Posted
Skills
Must have
- Bachelor's degree in cybersecurity, computer science, IT, engineering, data science, or related field plus 3+ years relevant experience (or equivalent education/training/experience)
- Experience in detection engineering, threat hunting, incident response, network defense, security analytics, or SOC operations
- Experience applying MITRE ATT&CK to adversary TTPs, telemetry, detection logic, and coverage-gap analysis
- Experience analyzing endpoint, network, system, or security-event data using SIEM, EDR, network-security-monitoring, or comparable analytics platforms
- Ability to develop and refine detection logic, queries, scripts, visualizations, and repeatable analytical processes
- Ability to evaluate whether security data is properly collected, parsed, normalized, enriched, indexed, searchable, and available to cyber operators
- Strong analytical, problem-solving, organizational, communication, and collaboration skills
- Ability to document and present complex technical findings to operator, engineering, mission, and leadership audiences
- Proficiency with Microsoft Word, Excel, and PowerPoint
- Must meet DoD 8140 qualification requirements for the assigned DCWF work role via an approved certification
- Active DoD Top Secret security clearance with SCI eligibility and U.S. citizenship
Nice to have
- Experience supporting DoD, USSF, DCO-S, intelligence-community, or other mission-system environments
- Experience with ATT&CK Navigator, purple-team exercises, adversary emulation, detection-as-code, or Sigma
- Experience with Bash scripting
- Current Security+, CySA+, or other certification approved for the assigned DCWF work role and proficiency level
Full description
For more than 50 years, ENSCO has been providing leading-edge engineering, science and advanced technology solutions to governments and private industries worldwide.
ENSCO prides itself in creating and applying advanced technologies for mission success. We provide systems engineering, integration, and advanced technology services to transform the future safety, security, and resiliency of critical missions on the ground, in the air, in space, and in the information systems that connect these domains.
Learn more about ENSCO.
Position Description
ENSCO, Inc. is seeking an on-site Cyber Intel Analyst / Penetration Tester to support Defensive Cyberspace Operations for Space (DCO-S) capabilities protecting critical U.S. Space Force mission systems.
The Cyber Detection Engineer will evaluate whether cybersecurity sensors, data pipelines, and analytic platforms provide sufficient visibility into adversary activity. The position analyzes endpoint, network, system, and security-event telemetry; maps observable activity to adversary tactics, techniques, and procedures (TTPs); and develops threat-informed products that communicate detection coverage and operational risk.
The successful candidate will collaborate across cybersecurity operations, threat analysis, systems administration, data engineering, and mission-system organizations to translate complex technical findings into actionable guidance.
This position is on-site in Colorado Springs, Colorado.
Responsibilities
-
Analyze endpoint, network, system, and security-event telemetry to identify detection opportunities and visibility gaps within DCO-S platforms.
-
Map mission-relevant threats, telemetry, and detections to MITRE ATT&CK.
-
Develop and maintain ATT&CK Navigator layers, detection-coverage heatmaps, and related threat-informed visualizations.
-
Assess adversary TTP coverage and classify techniques as fully covered, partially covered, unobserved, or unassessed.
-
Develop, test, document, tune, and automate detection logic, queries, scripts, and repeatable analytical processes.
-
Evaluate and validate security data from sensor collection through parsing, normalization, enrichment, ingestion, indexing, storage, search, and visualization.
-
Translate findings into operator guidance, including recommended searches, analytical methods, and relevant data sources.