Cyber Intel Analyst / Penetration Tester

ENSCO, Inc. is seeking an on-site Cyber Intel Analyst / Penetration Tester to support Defensive Cyberspace Operations for Space (DCO-S) in Colorado Springs, Colorado. In this role, you will help strengthen visibility and detection for critical U.S. Space Force mission systems by aligning telemetry with adversary behavior and MITRE ATT&CK techniques.

You will evaluate detection coverage, develop threat-informed products and detection logic, and validate whether security data collected by sensors is usable for operators. Work includes purple-team support and security data validation across collection, parsing, normalization, enrichment, ingestion, indexing, storage, search, and visualization.

What you’ll do

• Analyze endpoint, network, system, and security-event telemetry to identify detection opportunities and visibility gaps across DCO-S platforms.
• Map mission-relevant threats, telemetry, and detections to MITRE ATT&CK.
• Develop and maintain ATT&CK Navigator layers, detection-coverage heatmaps, and related threat-informed visualizations.
• Assess adversary TTP coverage and classify techniques as fully covered, partially covered, unobserved, or unassessed.
• Develop, test, document, tune, and automate detection logic, queries, scripts, and repeatable analytical processes.
• Evaluate and validate security data from sensor collection through parsing, normalization, enrichment, ingestion, indexing, storage, search, and visualization.
• Translate findings into operator guidance, including recommended searches, analytical methods, and relevant data sources.
• Support purple-team and threat-emulation activities by determining whether simulated adversary actions produce expected telemetry and detections.
• Document detection gaps, mission risks, and corrective actions for both technical and leadership audiences.
• Collaborate with cyber operators, intelligence analysts, system administrators, network engineers, quality-control personnel, and mission stakeholders to improve detection methodologies and testing procedures.
• Travel up to 10% to CONUS and OCONUS locations at the direction of the government customer.

Required qualifications

• Bachelor’s degree in cybersecurity, computer science, information technology, engineering, data science, or a related field, plus 3+ years of relevant experience (equivalent education, military training, certifications, and professional experience will be considered).
• Experience in detection engineering, threat hunting, incident response, network defense, security analytics, or SOC operations, including hands-on investigation, SIEM querying, detection tuning, threat hunting, telemetry analysis, or log-source validation.
• Experience applying MITRE ATT&CK to adversary TTPs, telemetry, detection logic, and coverage-gap analysis.
• Experience analyzing endpoint, network, system, or security-event data using SIEM, EDR, network-security-monitoring, or comparable analytics platforms.
• Ability to develop and refine detection logic, queries, scripts, visualizations, and repeatable analytical processes.
• Ability to evaluate whether security data is properly collected, parsed, normalized, enriched, indexed, searchable, and available to cyber operators.
• Strong analytical, problem-solving, organizational, communication, and collaboration skills.
• Ability to document and present complex technical findings to operator, engineering, mission, and leadership audiences.
• Proficiency with Microsoft Word, Excel, and PowerPoint.
• Must meet DoD 8140 qualification requirements for the assigned DCWF work role and proficiency level through an approved certification.
• Active DoD Top Secret security clearance with SCI eligibility and U.S. citizenship required.

Preferred qualifications

• Experience supporting DoD, USSF, DCO-S, intelligence-community, or other mission-system environments.
• Experience with ATT&CK Navigator, purple-team exercises, adversary emulation, detection-as-code, or Sigma.
• Experience with Bash scripting.
• Current Security+, CySA+, or other certification approved for the assigned DCWF work role and proficiency level.

Additional information

• Location: Colorado Springs, CO (onsite)
• Salary: USD 85,000 - 115,000 per year
• Technologies: MITRE ATT&CK, ATT&CK Navigator, SIEM, EDR, network-security-monitoring, Microsoft Word, Microsoft Excel, Microsoft PowerPoint, DoD 8140
• REAL ID requirement: This position may require access to U.S. federal facilities; individuals must present REAL ID-compliant identification or an acceptable alternative.
• Benefits: ENSCO offers a comprehensive benefits package (see ensco.com/careers/benefits).
• Export control and licensing: Access to technology or technical data controlled under U.S. export control laws may be required; release to a non-U.S. person may require an export license.
• Privacy: ENSCO privacy policy applies; California residents may click for California privacy rights.