diff --git a/x-pack/plugins/security_solution/public/management/cypress/common/constants.ts b/x-pack/plugins/security_solution/public/management/cypress/common/constants.ts
new file mode 100644
index 0000000000000..41f08f438e3f8
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/cypress/common/constants.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { EndpointSecurityRoleNames } from '../../../../scripts/endpoint/common/roles_users';
+
+export type KibanaKnownUserAccounts = keyof typeof KIBANA_KNOWN_DEFAULT_ACCOUNTS;
+
+export type SecurityTestUser = EndpointSecurityRoleNames | KibanaKnownUserAccounts;
+
+/**
+ * List of kibana system accounts
+ */
+export const KIBANA_KNOWN_DEFAULT_ACCOUNTS = {
+  elastic: 'elastic',
+  elastic_serverless: 'elastic_serverless',
+  system_indices_superuser: 'system_indices_superuser',
+} as const;
diff --git a/x-pack/plugins/security_solution/public/management/cypress/cypress.d.ts b/x-pack/plugins/security_solution/public/management/cypress/cypress.d.ts
index 4d84dc88af9c9..a4037e32632a5 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/cypress.d.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/cypress.d.ts
@@ -17,7 +17,12 @@ import type {
   HostPolicyResponse,
   LogsEndpointActionResponse,
 } from '../../../common/endpoint/types';
-import type { IndexEndpointHostsCyTaskOptions, HostActionResponse } from './types';
+import type {
+  HostActionResponse,
+  IndexEndpointHostsCyTaskOptions,
+  LoadUserAndRoleCyTaskOptions,
+  CreateUserAndRoleCyTaskOptions,
+} from './types';
 import type {
   DeleteIndexedFleetEndpointPoliciesResponse,
   IndexedFleetEndpointPolicyResponse,
@@ -32,6 +37,7 @@ import type {
   DeletedIndexedEndpointRuleAlerts,
   IndexedEndpointRuleAlerts,
 } from '../../../common/endpoint/data_loaders/index_endpoint_rule_alerts';
+import type { LoadedRoleAndUser } from '../../../scripts/endpoint/common/role_and_user_loader';
 
 declare global {
   namespace Cypress {
@@ -185,6 +191,18 @@ declare global {
         arg: { hostname: string; path: string; password?: string },
         options?: Partial<Loggable & Timeoutable>
       ): Chainable<string>;
+
+      task(
+        name: 'loadUserAndRole',
+        arg: LoadUserAndRoleCyTaskOptions,
+        options?: Partial<Loggable & Timeoutable>
+      ): Chainable<LoadedRoleAndUser>;
+
+      task(
+        name: 'createUserAndRole',
+        arg: CreateUserAndRoleCyTaskOptions,
+        options?: Partial<Loggable & Timeoutable>
+      ): Chainable<LoadedRoleAndUser>;
     }
   }
 }
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/artifacts/artifact_tabs_in_policy_details.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/artifacts/artifact_tabs_in_policy_details.cy.ts
index 39ebae1825365..8610ac1fc3ba5 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/artifacts/artifact_tabs_in_policy_details.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/artifacts/artifact_tabs_in_policy_details.cy.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { getRoleWithArtifactReadPrivilege } from '../../fixtures/role_with_artifact_read_privilege';
 import { getEndpointSecurityPolicyManager } from '../../../../../scripts/endpoint/common/roles_users/endpoint_security_policy_manager';
 import { getArtifactsListTestsData } from '../../fixtures/artifacts_page';
 import { visitPolicyDetailsPage } from '../../screens/policy_details';
@@ -16,27 +17,21 @@ import {
   yieldFirstPolicyID,
 } from '../../tasks/artifacts';
 import { loadEndpointDataForEventFiltersIfNeeded } from '../../tasks/load_endpoint_data';
-import {
-  getRoleWithArtifactReadPrivilege,
-  login,
-  loginWithCustomRole,
-  loginWithRole,
-  ROLE,
-} from '../../tasks/login';
+import { login, ROLE } from '../../tasks/login';
 import { performUserActions } from '../../tasks/perform_user_actions';
 
 const loginWithPrivilegeAll = () => {
-  loginWithRole(ROLE.endpoint_security_policy_manager);
+  login(ROLE.endpoint_policy_manager);
 };
 
 const loginWithPrivilegeRead = (privilegePrefix: string) => {
   const roleWithArtifactReadPrivilege = getRoleWithArtifactReadPrivilege(privilegePrefix);
-  loginWithCustomRole('roleWithArtifactReadPrivilege', roleWithArtifactReadPrivilege);
+  login.withCustomRole({ name: 'roleWithArtifactReadPrivilege', ...roleWithArtifactReadPrivilege });
 };
 
 const loginWithPrivilegeNone = (privilegePrefix: string) => {
   const roleWithoutArtifactPrivilege = getRoleWithoutArtifactPrivilege(privilegePrefix);
-  loginWithCustomRole('roleWithoutArtifactPrivilege', roleWithoutArtifactPrivilege);
+  login.withCustomRole({ name: 'roleWithoutArtifactPrivilege', ...roleWithoutArtifactPrivilege });
 };
 
 const getRoleWithoutArtifactPrivilege = (privilegePrefix: string) => {
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/artifacts/artifacts_mocked_data.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/artifacts/artifacts_mocked_data.cy.ts
index 8f575282ad3f7..86cd86dd797b7 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/artifacts/artifacts_mocked_data.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/artifacts/artifacts_mocked_data.cy.ts
@@ -5,13 +5,8 @@
  * 2.0.
  */
 
-import {
-  getRoleWithArtifactReadPrivilege,
-  login,
-  loginWithCustomRole,
-  loginWithRole,
-  ROLE,
-} from '../../tasks/login';
+import { getRoleWithArtifactReadPrivilege } from '../../fixtures/role_with_artifact_read_privilege';
+import { login, ROLE } from '../../tasks/login';
 import { loadPage } from '../../tasks/common';
 
 import { getArtifactsListTestsData } from '../../fixtures/artifacts_page';
@@ -20,18 +15,18 @@ import { performUserActions } from '../../tasks/perform_user_actions';
 import { loadEndpointDataForEventFiltersIfNeeded } from '../../tasks/load_endpoint_data';
 
 const loginWithWriteAccess = (url: string) => {
-  loginWithRole(ROLE.endpoint_security_policy_manager);
+  login(ROLE.endpoint_policy_manager);
   loadPage(url);
 };
 
 const loginWithReadAccess = (privilegePrefix: string, url: string) => {
   const roleWithArtifactReadPrivilege = getRoleWithArtifactReadPrivilege(privilegePrefix);
-  loginWithCustomRole('roleWithArtifactReadPrivilege', roleWithArtifactReadPrivilege);
+  login.withCustomRole({ name: 'roleWithArtifactReadPrivilege', ...roleWithArtifactReadPrivilege });
   loadPage(url);
 };
 
 const loginWithoutAccess = (url: string) => {
-  loginWithRole(ROLE.t1_analyst);
+  login(ROLE.t1_analyst);
   loadPage(url);
 };
 
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/form.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/form.cy.ts
index 84f6903c35a9b..eb5bae8624475 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/form.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/form.cy.ts
@@ -16,12 +16,12 @@ import {
 } from '../../tasks/response_actions';
 import { cleanupRule, generateRandomStringName, loadRule } from '../../tasks/api_fixtures';
 import { RESPONSE_ACTION_TYPES } from '../../../../../common/api/detection_engine';
-import { loginWithRole, ROLE } from '../../tasks/login';
+import { login, ROLE } from '../../tasks/login';
 
 describe('Form', { tags: '@ess' }, () => {
   describe('User with no access can not create an endpoint response action', () => {
     before(() => {
-      loginWithRole(ROLE.endpoint_response_actions_no_access);
+      login(ROLE.endpoint_response_actions_no_access);
     });
 
     it('no endpoint response action option during rule creation', () => {
@@ -36,7 +36,7 @@ describe('Form', { tags: '@ess' }, () => {
     const [ruleName, ruleDescription] = generateRandomStringName(2);
 
     before(() => {
-      loginWithRole(ROLE.endpoint_response_actions_access);
+      login(ROLE.endpoint_response_actions_access);
     });
     after(() => {
       cleanupRule(ruleId);
@@ -94,7 +94,7 @@ describe('Form', { tags: '@ess' }, () => {
       });
     });
     beforeEach(() => {
-      loginWithRole(ROLE.endpoint_response_actions_access);
+      login(ROLE.endpoint_response_actions_access);
     });
     after(() => {
       cleanupRule(ruleId);
@@ -146,7 +146,7 @@ describe('Form', { tags: '@ess' }, () => {
     const [ruleName, ruleDescription] = generateRandomStringName(2);
 
     before(() => {
-      loginWithRole(ROLE.endpoint_response_actions_no_access);
+      login(ROLE.endpoint_response_actions_no_access);
     });
 
     it('response actions are disabled', () => {
@@ -166,7 +166,7 @@ describe('Form', { tags: '@ess' }, () => {
       loadRule().then((res) => {
         ruleId = res.id;
       });
-      loginWithRole(ROLE.endpoint_response_actions_no_access);
+      login(ROLE.endpoint_response_actions_no_access);
     });
     after(() => {
       cleanupRule(ruleId);
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/no_license.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/no_license.cy.ts
index edbaa90d3200c..eb6191ece0460 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/no_license.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/no_license.cy.ts
@@ -9,7 +9,7 @@ import { disableExpandableFlyoutAdvancedSettings } from '../../tasks/common';
 import { APP_ALERTS_PATH } from '../../../../../common/constants';
 import { closeAllToasts } from '../../tasks/toasts';
 import { fillUpNewRule } from '../../tasks/response_actions';
-import { login, loginWithRole, ROLE } from '../../tasks/login';
+import { login, ROLE } from '../../tasks/login';
 import { generateRandomStringName } from '../../tasks/utils';
 import type { ReturnTypeFromChainable } from '../../types';
 import { indexEndpointHosts } from '../../tasks/index_endpoint_hosts';
@@ -20,7 +20,7 @@ describe('No License', { tags: '@ess', env: { ftrConfig: { license: 'basic' } }
     const [ruleName, ruleDescription] = generateRandomStringName(2);
 
     before(() => {
-      loginWithRole(ROLE.endpoint_response_actions_access);
+      login(ROLE.endpoint_response_actions_access);
     });
 
     it('response actions are disabled', () => {
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/endpoint_list_with_security_essentials.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/endpoint_list_with_security_essentials.cy.ts
index 58c41539361c5..32800978a968e 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/endpoint_list_with_security_essentials.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/endpoint_list_with_security_essentials.cy.ts
@@ -7,7 +7,7 @@
 
 import type { CyIndexEndpointHosts } from '../../tasks/index_endpoint_hosts';
 import { indexEndpointHosts } from '../../tasks/index_endpoint_hosts';
-import { loginServerless } from '../../tasks/login_serverless';
+import { login } from '../../tasks/login';
 import {
   getConsoleActionMenuItem,
   getUnIsolateActionMenuItem,
@@ -42,7 +42,7 @@ describe(
       });
 
       beforeEach(() => {
-        loginServerless();
+        login();
         visitEndpointList();
         openRowActionMenu();
       });
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/feature_access/complete.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/feature_access/complete.cy.ts
index 7c4323b2aa689..dba7166b9a9e8 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/feature_access/complete.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/feature_access/complete.cy.ts
@@ -6,7 +6,7 @@
  */
 
 import { ensureResponseActionAuthzAccess } from '../../../tasks/response_actions';
-import { loginServerless, ServerlessUser } from '../../../tasks/login_serverless';
+import { login, ROLE } from '../../../tasks/login';
 import { RESPONSE_ACTION_API_COMMANDS_NAMES } from '../../../../../../common/endpoint/service/response_actions/constants';
 import { getNoPrivilegesPage } from '../../../screens/common';
 import { getEndpointManagementPageList } from '../../../screens';
@@ -31,7 +31,7 @@ describe(
     let password: string;
 
     beforeEach(() => {
-      loginServerless(ServerlessUser.ENDPOINT_OPERATIONS_ANALYST).then((response) => {
+      login(ROLE.endpoint_operations_analyst).then((response) => {
         username = response.username;
         password = response.password;
       });
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/feature_access/complete_with_endpoint.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/feature_access/complete_with_endpoint.cy.ts
index f3ae8b85a9f24..3c028b9e25040 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/feature_access/complete_with_endpoint.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/feature_access/complete_with_endpoint.cy.ts
@@ -6,7 +6,7 @@
  */
 
 import { ensureResponseActionAuthzAccess } from '../../../tasks/response_actions';
-import { loginServerless, ServerlessUser } from '../../../tasks/login_serverless';
+import { login, ROLE } from '../../../tasks/login';
 import { RESPONSE_ACTION_API_COMMANDS_NAMES } from '../../../../../../common/endpoint/service/response_actions/constants';
 import {
   getEndpointManagementPageList,
@@ -33,7 +33,7 @@ describe(
     let password: string;
 
     beforeEach(() => {
-      loginServerless(ServerlessUser.ENDPOINT_OPERATIONS_ANALYST).then((response) => {
+      login(ROLE.endpoint_operations_analyst).then((response) => {
         username = response.username;
         password = response.password;
       });
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/feature_access/essentials.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/feature_access/essentials.cy.ts
index 900a5d81a9f46..fed4494722df5 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/feature_access/essentials.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/feature_access/essentials.cy.ts
@@ -6,7 +6,7 @@
  */
 
 import { ensureResponseActionAuthzAccess } from '../../../tasks/response_actions';
-import { loginServerless, ServerlessUser } from '../../../tasks/login_serverless';
+import { login, ROLE } from '../../../tasks/login';
 import { RESPONSE_ACTION_API_COMMANDS_NAMES } from '../../../../../../common/endpoint/service/response_actions/constants';
 import { getNoPrivilegesPage } from '../../../screens/common';
 import { getEndpointManagementPageList } from '../../../screens';
@@ -33,7 +33,7 @@ describe(
     let password: string;
 
     beforeEach(() => {
-      loginServerless(ServerlessUser.ENDPOINT_OPERATIONS_ANALYST).then((response) => {
+      login(ROLE.endpoint_operations_analyst).then((response) => {
         username = response.username;
         password = response.password;
       });
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/feature_access/essentials_with_endpoint.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/feature_access/essentials_with_endpoint.cy.ts
index 7196b73f6813a..172f850e44b7c 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/feature_access/essentials_with_endpoint.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/feature_access/essentials_with_endpoint.cy.ts
@@ -6,7 +6,7 @@
  */
 
 import { ensureResponseActionAuthzAccess } from '../../../tasks/response_actions';
-import { loginServerless, ServerlessUser } from '../../../tasks/login_serverless';
+import { login, ROLE } from '../../../tasks/login';
 import { RESPONSE_ACTION_API_COMMANDS_NAMES } from '../../../../../../common/endpoint/service/response_actions/constants';
 import {
   getEndpointManagementPageMap,
@@ -41,7 +41,7 @@ describe(
     let password: string;
 
     beforeEach(() => {
-      loginServerless(ServerlessUser.ENDPOINT_OPERATIONS_ANALYST).then((response) => {
+      login(ROLE.endpoint_operations_analyst).then((response) => {
         username = response.username;
         password = response.password;
       });
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/policy_details_with_security_essentials.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/policy_details_with_security_essentials.cy.ts
index faf9aba6237b3..e1516bb08e10e 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/policy_details_with_security_essentials.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/policy_details_with_security_essentials.cy.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { loginServerless } from '../../tasks/login_serverless';
+import { login } from '../../tasks/login';
 import { visitPolicyDetailsPage } from '../../screens/policy_details';
 import type { IndexedFleetEndpointPolicyResponse } from '../../../../../common/endpoint/data_loaders/index_fleet_endpoint_policy';
 
@@ -35,7 +35,7 @@ describe(
     });
 
     beforeEach(() => {
-      loginServerless();
+      login();
       visitPolicyDetailsPage(loadedPolicyData.integrationPolicies[0].id);
     });
 
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/roles/complete_with_endpoint_roles.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/roles/complete_with_endpoint_roles.cy.ts
index 879948a65c47d..534b681c2aeb4 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/roles/complete_with_endpoint_roles.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/roles/complete_with_endpoint_roles.cy.ts
@@ -8,7 +8,7 @@
 import { pick } from 'lodash';
 import type { CyIndexEndpointHosts } from '../../../tasks/index_endpoint_hosts';
 import { indexEndpointHosts } from '../../../tasks/index_endpoint_hosts';
-import { loginServerless, ServerlessUser } from '../../../tasks/login_serverless';
+import { login, ROLE } from '../../../tasks/login';
 import { ensurePolicyDetailsPageAuthzAccess } from '../../../screens/policy_details';
 import type { EndpointArtifactPageId } from '../../../screens';
 import {
@@ -63,12 +63,12 @@ describe(
     });
 
     // roles `t1_analyst` and `t2_analyst` are very similar with exception of one page
-    (['t1_analyst', `t2_analyst`] as ServerlessUser[]).forEach((roleName) => {
+    (['t1_analyst', `t2_analyst`] as ROLE[]).forEach((roleName) => {
       describe(`for role: ${roleName}`, () => {
         const deniedPages = allPages.filter((page) => page.id !== 'endpointList');
 
         beforeEach(() => {
-          loginServerless(roleName);
+          login(roleName);
         });
 
         it('should have READ access to Endpoint list page', () => {
@@ -124,7 +124,7 @@ describe(
       const deniedResponseActions = pick(consoleHelpPanelResponseActionsTestSubj, 'execute');
 
       beforeEach(() => {
-        loginServerless(ServerlessUser.T3_ANALYST);
+        login(ROLE.t3_analyst);
       });
 
       it('should have access to Endpoint list page', () => {
@@ -176,7 +176,7 @@ describe(
       const deniedPages = allPages.filter(({ id }) => id !== 'blocklist' && id !== 'endpointList');
 
       beforeEach(() => {
-        loginServerless(ServerlessUser.THREAT_INTELLIGENCE_ANALYST);
+        login(ROLE.threat_intelligence_analyst);
       });
 
       it('should have access to Endpoint list page', () => {
@@ -221,7 +221,7 @@ describe(
       ];
 
       beforeEach(() => {
-        loginServerless(ServerlessUser.RULE_AUTHOR);
+        login(ROLE.rule_author);
       });
 
       for (const { id, title } of artifactPagesFullAccess) {
@@ -272,7 +272,7 @@ describe(
       const grantedAccessPages = [pageById.endpointList, pageById.policyList];
 
       beforeEach(() => {
-        loginServerless(ServerlessUser.SOC_MANAGER);
+        login(ROLE.soc_manager);
       });
 
       for (const { id, title } of artifactPagesFullAccess) {
@@ -319,7 +319,7 @@ describe(
       const grantedAccessPages = [pageById.endpointList, pageById.policyList];
 
       beforeEach(() => {
-        loginServerless(ServerlessUser.ENDPOINT_OPERATIONS_ANALYST);
+        login(ROLE.endpoint_operations_analyst);
       });
 
       for (const { id, title } of artifactPagesFullAccess) {
@@ -350,7 +350,7 @@ describe(
       });
     });
 
-    (['platform_engineer', 'endpoint_policy_manager'] as ServerlessUser[]).forEach((roleName) => {
+    (['platform_engineer', 'endpoint_policy_manager'] as ROLE[]).forEach((roleName) => {
       describe(`for role: ${roleName}`, () => {
         const artifactPagesFullAccess = [
           pageById.trustedApps,
@@ -361,7 +361,7 @@ describe(
         const grantedAccessPages = [pageById.endpointList, pageById.policyList];
 
         beforeEach(() => {
-          loginServerless(roleName);
+          login(roleName);
         });
 
         for (const { id, title } of artifactPagesFullAccess) {
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/roles/essentials_with_endpoint.roles.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/roles/essentials_with_endpoint.roles.cy.ts
index fec6a0f803afb..6cf3ab727980a 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/roles/essentials_with_endpoint.roles.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/serverless/roles/essentials_with_endpoint.roles.cy.ts
@@ -7,7 +7,7 @@
 
 import type { CyIndexEndpointHosts } from '../../../tasks/index_endpoint_hosts';
 import { indexEndpointHosts } from '../../../tasks/index_endpoint_hosts';
-import { loginServerless, ServerlessUser } from '../../../tasks/login_serverless';
+import { login, ROLE } from '../../../tasks/login';
 import type { EndpointArtifactPageId } from '../../../screens';
 import {
   getNoPrivilegesPage,
@@ -55,12 +55,12 @@ describe(
     });
 
     // roles `t1_analyst` and `t2_analyst` are the same as far as endpoint access
-    (['t1_analyst', `t2_analyst`] as ServerlessUser[]).forEach((roleName) => {
+    (['t1_analyst', `t2_analyst`] as ROLE[]).forEach((roleName) => {
       describe(`for role: ${roleName}`, () => {
         const deniedPages = allPages.filter((page) => page.id !== 'endpointList');
 
         beforeEach(() => {
-          loginServerless(roleName);
+          login(roleName);
         });
 
         it('should have READ access to Endpoint list page', () => {
@@ -89,7 +89,7 @@ describe(
       ];
 
       beforeEach(() => {
-        loginServerless(ServerlessUser.T3_ANALYST);
+        login(ROLE.t3_analyst);
       });
 
       it('should have access to Endpoint list page', () => {
@@ -128,7 +128,7 @@ describe(
       const deniedPages = allPages.filter(({ id }) => id !== 'blocklist' && id !== 'endpointList');
 
       beforeEach(() => {
-        loginServerless(ServerlessUser.THREAT_INTELLIGENCE_ANALYST);
+        login(ROLE.threat_intelligence_analyst);
       });
 
       it('should have access to Endpoint list page', () => {
@@ -163,7 +163,7 @@ describe(
       ];
 
       beforeEach(() => {
-        loginServerless(ServerlessUser.RULE_AUTHOR);
+        login(ROLE.rule_author);
       });
 
       for (const { id, title } of artifactPagesFullAccess) {
@@ -207,7 +207,7 @@ describe(
       const grantedAccessPages = [pageById.endpointList, pageById.policyList];
 
       beforeEach(() => {
-        loginServerless(ServerlessUser.SOC_MANAGER);
+        login(ROLE.soc_manager);
       });
 
       for (const { id, title } of artifactPagesFullAccess) {
@@ -238,11 +238,7 @@ describe(
 
     // Endpoint Operations Manager, Endpoint Policy Manager and Platform Engineer currently have the same level of access
     (
-      [
-        'platform_engineer',
-        `endpoint_operations_analyst`,
-        'endpoint_policy_manager',
-      ] as ServerlessUser[]
+      ['platform_engineer', `endpoint_operations_analyst`, 'endpoint_policy_manager'] as ROLE[]
     ).forEach((roleName) => {
       describe(`for role: ${roleName}`, () => {
         const artifactPagesFullAccess = [
@@ -253,7 +249,7 @@ describe(
         const grantedAccessPages = [pageById.endpointList, pageById.policyList];
 
         beforeEach(() => {
-          loginServerless(roleName);
+          login(roleName);
         });
 
         for (const { id, title } of artifactPagesFullAccess) {
diff --git a/x-pack/plugins/security_solution/public/management/cypress/fixtures/role_with_artifact_read_privilege.ts b/x-pack/plugins/security_solution/public/management/cypress/fixtures/role_with_artifact_read_privilege.ts
new file mode 100644
index 0000000000000..247b491f04632
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/cypress/fixtures/role_with_artifact_read_privilege.ts
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getEndpointSecurityPolicyManager } from '../../../../scripts/endpoint/common/roles_users';
+
+export const getRoleWithArtifactReadPrivilege = (privilegePrefix: string) => {
+  const endpointSecurityPolicyManagerRole = getEndpointSecurityPolicyManager();
+
+  return {
+    ...endpointSecurityPolicyManagerRole,
+    kibana: [
+      {
+        ...endpointSecurityPolicyManagerRole.kibana[0],
+        feature: {
+          ...endpointSecurityPolicyManagerRole.kibana[0].feature,
+          siem: [
+            ...endpointSecurityPolicyManagerRole.kibana[0].feature.siem.filter(
+              (privilege) => privilege !== `${privilegePrefix}all`
+            ),
+            `${privilegePrefix}read`,
+          ],
+        },
+      },
+    ],
+  };
+};
diff --git a/x-pack/plugins/security_solution/public/management/cypress/support/data_loaders.ts b/x-pack/plugins/security_solution/public/management/cypress/support/data_loaders.ts
index 4d8164391cb11..93614b6dbb86d 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/support/data_loaders.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/support/data_loaders.ts
@@ -9,6 +9,14 @@
 
 import type { CasePostRequest } from '@kbn/cases-plugin/common';
 import execa from 'execa';
+import type { KbnClient } from '@kbn/test';
+import type { ToolingLog } from '@kbn/tooling-log';
+import type { KibanaKnownUserAccounts } from '../common/constants';
+import { KIBANA_KNOWN_DEFAULT_ACCOUNTS } from '../common/constants';
+import type { EndpointSecurityRoleNames } from '../../../../scripts/endpoint/common/roles_users';
+import { SECURITY_SERVERLESS_ROLE_NAMES } from '../../../../scripts/endpoint/common/roles_users';
+import type { LoadedRoleAndUser } from '../../../../scripts/endpoint/common/role_and_user_loader';
+import { EndpointSecurityTestRolesLoader } from '../../../../scripts/endpoint/common/role_and_user_loader';
 import { startRuntimeServices } from '../../../../scripts/endpoint/endpoint_agent_runner/runtime';
 import { runFleetServerIfNeeded } from '../../../../scripts/endpoint/endpoint_agent_runner/fleet_server';
 import {
@@ -22,39 +30,89 @@ import type {
   CreateAndEnrollEndpointHostOptions,
   CreateAndEnrollEndpointHostResponse,
 } from '../../../../scripts/endpoint/common/endpoint_host_services';
+import {
+  createAndEnrollEndpointHost,
+  destroyEndpointHost,
+  startEndpointHost,
+  stopEndpointHost,
+  VAGRANT_CWD,
+} from '../../../../scripts/endpoint/common/endpoint_host_services';
 import type { IndexedEndpointPolicyResponse } from '../../../../common/endpoint/data_loaders/index_endpoint_policy_response';
 import {
   deleteIndexedEndpointPolicyResponse,
   indexEndpointPolicyResponse,
 } from '../../../../common/endpoint/data_loaders/index_endpoint_policy_response';
 import type { ActionDetails, HostPolicyResponse } from '../../../../common/endpoint/types';
-import type { IndexEndpointHostsCyTaskOptions } from '../types';
 import type {
-  IndexedEndpointRuleAlerts,
+  IndexEndpointHostsCyTaskOptions,
+  LoadUserAndRoleCyTaskOptions,
+  CreateUserAndRoleCyTaskOptions,
+} from '../types';
+import type {
   DeletedIndexedEndpointRuleAlerts,
+  IndexedEndpointRuleAlerts,
+} from '../../../../common/endpoint/data_loaders/index_endpoint_rule_alerts';
+import {
+  deleteIndexedEndpointRuleAlerts,
+  indexEndpointRuleAlerts,
 } from '../../../../common/endpoint/data_loaders/index_endpoint_rule_alerts';
 import type { IndexedHostsAndAlertsResponse } from '../../../../common/endpoint/index_data';
+import { deleteIndexedHostsAndAlerts } from '../../../../common/endpoint/index_data';
 import type { IndexedCase } from '../../../../common/endpoint/data_loaders/index_case';
+import { deleteIndexedCase, indexCase } from '../../../../common/endpoint/data_loaders/index_case';
 import { createRuntimeServices } from '../../../../scripts/endpoint/common/stack_services';
 import type { IndexedFleetEndpointPolicyResponse } from '../../../../common/endpoint/data_loaders/index_fleet_endpoint_policy';
 import {
-  indexFleetEndpointPolicy,
   deleteIndexedFleetEndpointPolicies,
+  indexFleetEndpointPolicy,
 } from '../../../../common/endpoint/data_loaders/index_fleet_endpoint_policy';
-import { deleteIndexedCase, indexCase } from '../../../../common/endpoint/data_loaders/index_case';
 import { cyLoadEndpointDataHandler } from './plugin_handlers/endpoint_data_loader';
-import { deleteIndexedHostsAndAlerts } from '../../../../common/endpoint/index_data';
-import {
-  deleteIndexedEndpointRuleAlerts,
-  indexEndpointRuleAlerts,
-} from '../../../../common/endpoint/data_loaders/index_endpoint_rule_alerts';
-import {
-  startEndpointHost,
-  createAndEnrollEndpointHost,
-  destroyEndpointHost,
-  stopEndpointHost,
-  VAGRANT_CWD,
-} from '../../../../scripts/endpoint/common/endpoint_host_services';
+
+/**
+ * Test Role/User loader for cypress. Checks to see if running in serverless and handles it as appropriate
+ */
+class TestRoleAndUserLoader extends EndpointSecurityTestRolesLoader {
+  constructor(
+    protected readonly kbnClient: KbnClient,
+    protected readonly logger: ToolingLog,
+    private readonly isServerless: boolean
+  ) {
+    super(kbnClient, logger);
+  }
+
+  async load(
+    name: EndpointSecurityRoleNames | KibanaKnownUserAccounts
+  ): Promise<LoadedRoleAndUser> {
+    // If its a known system account, then just exit here and use the default `changeme` password
+    if (KIBANA_KNOWN_DEFAULT_ACCOUNTS[name as KibanaKnownUserAccounts]) {
+      return {
+        role: name,
+        username: name,
+        password: 'changeme',
+      };
+    }
+
+    if (this.isServerless) {
+      // If the username is not one that we support in serverless, then throw an error.
+      if (!SECURITY_SERVERLESS_ROLE_NAMES[name as keyof typeof SECURITY_SERVERLESS_ROLE_NAMES]) {
+        throw new Error(
+          `username [${name}] is not valid when running in serverless. Valid values are: ${Object.keys(
+            SECURITY_SERVERLESS_ROLE_NAMES
+          ).join(', ')}`
+        );
+      }
+
+      // Roles/users for serverless will be already present in the env, so just return the defaults creds
+      return {
+        role: name,
+        username: name,
+        password: 'changeme',
+      };
+    }
+
+    return super.load(name as EndpointSecurityRoleNames);
+  }
+}
 
 /**
  * Cypress plugin for adding data loading related `task`s
@@ -68,7 +126,8 @@ export const dataLoaders = (
   on: Cypress.PluginEvents,
   config: Cypress.PluginConfigOptions
 ): void => {
-  // FIXME: investigate if we can create a `ToolingLog` that writes output to cypress and pass that to the stack services
+  // Env. variable is set by `cypress_serverless.config.ts`
+  const isServerless = config.env.IS_SERVERLESS;
 
   const stackServicesPromise = createRuntimeServices({
     kibanaUrl: config.env.KIBANA_URL,
@@ -81,6 +140,12 @@ export const dataLoaders = (
     asSuperuser: true,
   });
 
+  const roleAndUserLoaderPromise: Promise<TestRoleAndUserLoader> = stackServicesPromise.then(
+    ({ kbnClient, log }) => {
+      return new TestRoleAndUserLoader(kbnClient, log, isServerless);
+    }
+  );
+
   on('task', {
     indexFleetEndpointPolicy: async ({
       policyName,
@@ -201,6 +266,23 @@ export const dataLoaders = (
       const { esClient } = await stackServicesPromise;
       return deleteAllEndpointData(esClient, endpointAgentIds);
     },
+
+    /**
+     * Loads a user/role into Kibana. Used from `login()` task.
+     * @param name
+     */
+    loadUserAndRole: async ({ name }: LoadUserAndRoleCyTaskOptions): Promise<LoadedRoleAndUser> => {
+      return (await roleAndUserLoaderPromise).load(name);
+    },
+
+    /**
+     * Creates a new Role/User
+     */
+    createUserAndRole: async ({
+      role,
+    }: CreateUserAndRoleCyTaskOptions): Promise<LoadedRoleAndUser> => {
+      return (await roleAndUserLoaderPromise).create(role);
+    },
   });
 };
 
diff --git a/x-pack/plugins/security_solution/public/management/cypress/tasks/login.ts b/x-pack/plugins/security_solution/public/management/cypress/tasks/login.ts
index 58eba62a72f82..8ac78b508d084 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/tasks/login.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/tasks/login.ts
@@ -5,242 +5,107 @@
  * 2.0.
  */
 
-import * as yaml from 'js-yaml';
-import type { Role } from '@kbn/security-plugin/common';
 import type { LoginState } from '@kbn/security-plugin/common/login_state';
-import { getWithResponseActionsRole } from '../../../../scripts/endpoint/common/roles_users/with_response_actions_role';
-import { getNoResponseActionsRole } from '../../../../scripts/endpoint/common/roles_users/without_response_actions_role';
-import { request } from './common';
-import { getT1Analyst } from '../../../../scripts/endpoint/common/roles_users/t1_analyst';
-import { getT2Analyst } from '../../../../scripts/endpoint/common/roles_users/t2_analyst';
-import { getHunter } from '../../../../scripts/endpoint/common/roles_users/hunter';
-import { getThreatIntelligenceAnalyst } from '../../../../scripts/endpoint/common/roles_users/threat_intelligence_analyst';
-import { getSocManager } from '../../../../scripts/endpoint/common/roles_users/soc_manager';
-import { getPlatformEngineer } from '../../../../scripts/endpoint/common/roles_users/platform_engineer';
-import { getEndpointOperationsAnalyst } from '../../../../scripts/endpoint/common/roles_users/endpoint_operations_analyst';
-import {
-  getEndpointSecurityPolicyManagementReadRole,
-  getEndpointSecurityPolicyManager,
-} from '../../../../scripts/endpoint/common/roles_users/endpoint_security_policy_manager';
-import { getDetectionsEngineer } from '../../../../scripts/endpoint/common/roles_users/detections_engineer';
-
-export enum ROLE {
-  t1_analyst = 't1Analyst',
-  t2_analyst = 't2Analyst',
-  analyst_hunter = 'hunter',
-  threat_intelligence_analyst = 'threatIntelligenceAnalyst',
-  detections_engineer = 'detectionsEngineer',
-  soc_manager = 'socManager',
-  platform_engineer = 'platformEngineer',
-  endpoint_operations_analyst = 'endpointOperationsAnalyst',
-  endpoint_security_policy_manager = 'endpointSecurityPolicyManager',
-  endpoint_response_actions_access = 'endpointResponseActionsAccess',
-  endpoint_response_actions_no_access = 'endpointResponseActionsNoAccess',
-  endpoint_security_policy_management_read = 'endpointSecurityPolicyManagementRead',
+import type { Role } from '@kbn/security-plugin/common';
+import { ENDPOINT_SECURITY_ROLE_NAMES } from '../../../../scripts/endpoint/common/roles_users';
+import type { SecurityTestUser } from '../common/constants';
+import { COMMON_API_HEADERS, request } from './common';
+
+export const ROLE = Object.freeze<Record<SecurityTestUser, SecurityTestUser>>({
+  ...ENDPOINT_SECURITY_ROLE_NAMES,
+  elastic: 'elastic',
+  elastic_serverless: 'elastic_serverless',
+  system_indices_superuser: 'system_indices_superuser',
+});
+
+interface CyLoginTask {
+  (user?: SecurityTestUser): ReturnType<typeof sendApiLoginRequest>;
+
+  /**
+   * Login using any username/password
+   * @param username
+   * @param password
+   */
+  with(username: string, password: string): ReturnType<typeof sendApiLoginRequest>;
+
+  /**
+   * Creates the provided role in kibana/ES along with a respective user (same name as role)
+   * and then login with this new user
+   * @param role
+   */
+  withCustomRole(role: Role): ReturnType<typeof sendApiLoginRequest>;
 }
 
-export const rolesMapping: { [key in ROLE]: Omit<Role, 'name'> } = {
-  t1Analyst: getT1Analyst(),
-  t2Analyst: getT2Analyst(),
-  hunter: getHunter(),
-  threatIntelligenceAnalyst: getThreatIntelligenceAnalyst(),
-  socManager: getSocManager(),
-  platformEngineer: getPlatformEngineer(),
-  endpointOperationsAnalyst: getEndpointOperationsAnalyst(),
-  endpointSecurityPolicyManager: getEndpointSecurityPolicyManager(),
-  detectionsEngineer: getDetectionsEngineer(),
-  endpointResponseActionsAccess: getWithResponseActionsRole(),
-  endpointResponseActionsNoAccess: getNoResponseActionsRole(),
-  endpointSecurityPolicyManagementRead: getEndpointSecurityPolicyManagementReadRole(),
-};
-/**
- * Credentials in the `kibana.dev.yml` config file will be used to authenticate
- * with Kibana when credentials are not provided via environment variables
- */
-const KIBANA_DEV_YML_PATH = '../../../config/kibana.dev.yml';
-
-/**
- * The configuration path in `kibana.dev.yml` to the username to be used when
- * authenticating with Kibana.
- */
-const ELASTICSEARCH_USERNAME_CONFIG_PATH = 'config.elasticsearch.username';
-
-/**
- * The configuration path in `kibana.dev.yml` to the password to be used when
- * authenticating with Kibana.
- */
-const ELASTICSEARCH_PASSWORD_CONFIG_PATH = 'config.elasticsearch.password';
-
-/**
- * The `CYPRESS_ELASTICSEARCH_USERNAME` environment variable specifies the
- * username to be used when authenticating with Kibana
- */
-const ELASTICSEARCH_USERNAME = 'ELASTICSEARCH_USERNAME';
-
 /**
- * The `CYPRESS_ELASTICSEARCH_PASSWORD` environment variable specifies the
- * username to be used when authenticating with Kibana
+ * Login to Kibana using API (not login page).
+ * By default, user will be logged in using `KIBANA_USERNAME` and `KIBANA_PASSWORD` retrieved from
+ * the cypress `env`
+ *
+ * @param user
  */
-const ELASTICSEARCH_PASSWORD = 'ELASTICSEARCH_PASSWORD';
-
-const KIBANA_USERNAME = 'KIBANA_USERNAME';
-const KIBANA_PASSWORD = 'KIBANA_PASSWORD';
+export const login: CyLoginTask = (
+  // FIXME:PT default user to `soc_manager`
+  user?: SecurityTestUser
+): ReturnType<typeof sendApiLoginRequest> => {
+  let username = Cypress.env('KIBANA_USERNAME');
+  let password = Cypress.env('KIBANA_PASSWORD');
+
+  if (user) {
+    return cy.task('loadUserAndRole', { name: user }).then((loadedUser) => {
+      username = loadedUser.username;
+      password = loadedUser.password;
+
+      return sendApiLoginRequest(username, password);
+    });
+  } else {
+    return sendApiLoginRequest(username, password);
+  }
+};
 
-export const createCustomRoleAndUser = (role: string, rolePrivileges: Omit<Role, 'name'>) => {
-  // post the role
-  request({
-    method: 'PUT',
-    url: `/api/security/role/${role}`,
-    body: rolePrivileges,
-  });
+login.with = (username: string, password: string): ReturnType<typeof sendApiLoginRequest> => {
+  return sendApiLoginRequest(username, password);
+};
 
-  // post the user associated with the role to elasticsearch
-  request({
-    method: 'POST',
-    url: `/internal/security/users/${role}`,
-    body: {
-      username: role,
-      password: Cypress.env(ELASTICSEARCH_PASSWORD),
-      roles: [role],
-    },
+login.withCustomRole = (role: Role): ReturnType<typeof sendApiLoginRequest> => {
+  return cy.task('createUserAndRole', { role }).then(({ username, password }) => {
+    return sendApiLoginRequest(username, password);
   });
 };
 
-const loginWithUsernameAndPassword = (username: string, password: string) => {
+/**
+ * Send login via API
+ * @param username
+ * @param password
+ *
+ * @private
+ */
+const sendApiLoginRequest = (
+  username: string,
+  password: string
+): Cypress.Chainable<{ username: string; password: string }> => {
   const baseUrl = Cypress.config().baseUrl;
-  if (!baseUrl) {
-    throw Error(`Cypress config baseUrl not set!`);
-  }
+  const loginUrl = `${baseUrl}/internal/security/login`;
+  const headers = { ...COMMON_API_HEADERS };
+
+  cy.log(`Authenticating [${username}] via ${loginUrl}`);
 
-  // Programmatically authenticate without interacting with the Kibana login page.
-  const headers = { 'kbn-xsrf': 'cypress-creds' };
-  request<LoginState>({ headers, url: `${baseUrl}/internal/security/login_state` }).then(
-    (loginState) => {
+  return request<LoginState>({ headers, url: `${baseUrl}/internal/security/login_state` })
+    .then((loginState) => {
       const basicProvider = loginState.body.selector.providers.find(
         (provider) => provider.type === 'basic'
       );
+
       return request({
-        url: `${baseUrl}/internal/security/login`,
+        url: loginUrl,
         method: 'POST',
         headers,
         body: {
-          providerType: basicProvider.type,
-          providerName: basicProvider.name,
+          providerType: basicProvider?.type,
+          providerName: basicProvider?.name,
           currentURL: '/',
           params: { username, password },
         },
       });
-    }
-  );
-};
-
-export const loginWithRole = (role: ROLE) => {
-  loginWithCustomRole(role, rolesMapping[role]);
-};
-
-export const loginWithCustomRole = (role: string, rolePrivileges: Omit<Role, 'name'>) => {
-  createCustomRoleAndUser(role, rolePrivileges);
-
-  cy.log(`origin: ${Cypress.config().baseUrl}`);
-
-  loginWithUsernameAndPassword(role, Cypress.env(ELASTICSEARCH_PASSWORD));
-};
-
-/**
- * Authenticates with Kibana using, if specified, credentials specified by
- * environment variables. The credentials in `kibana.dev.yml` will be used
- * for authentication when the environment variables are unset.
- *
- * To speed the execution of tests, prefer this non-interactive authentication,
- * which is faster than authentication via Kibana's interactive login page.
- */
-export const login = (role?: ROLE) => {
-  if (role != null) {
-    loginWithRole(role);
-  } else if (credentialsProvidedByEnvironment()) {
-    loginViaEnvironmentCredentials();
-  } else {
-    loginViaConfig();
-  }
-};
-
-/**
- * Returns `true` if the credentials used to login to Kibana are provided
- * via environment variables
- */
-const credentialsProvidedByEnvironment = (): boolean =>
-  (Cypress.env(KIBANA_USERNAME) != null && Cypress.env(KIBANA_PASSWORD) != null) ||
-  (Cypress.env(ELASTICSEARCH_USERNAME) != null && Cypress.env(ELASTICSEARCH_PASSWORD) != null);
-
-/**
- * Authenticates with Kibana by reading credentials from the
- * `CYPRESS_ELASTICSEARCH_USERNAME` and `CYPRESS_ELASTICSEARCH_PASSWORD`
- * environment variables, and POSTing the username and password directly to
- * Kibana's `/internal/security/login` endpoint, bypassing the login page (for speed).
- */
-const loginViaEnvironmentCredentials = () => {
-  let username: string;
-  let password: string;
-  let usernameEnvVar: string;
-  let passwordEnvVar: string;
-
-  if (Cypress.env(KIBANA_USERNAME) && Cypress.env(KIBANA_PASSWORD)) {
-    username = Cypress.env(KIBANA_USERNAME);
-    password = Cypress.env(KIBANA_PASSWORD);
-    usernameEnvVar = KIBANA_USERNAME;
-    passwordEnvVar = KIBANA_PASSWORD;
-  } else {
-    username = Cypress.env(ELASTICSEARCH_USERNAME);
-    password = Cypress.env(ELASTICSEARCH_PASSWORD);
-    usernameEnvVar = ELASTICSEARCH_USERNAME;
-    passwordEnvVar = ELASTICSEARCH_PASSWORD;
-  }
-
-  cy.log(
-    `Authenticating user [${username}] retrieved via environment credentials from the \`CYPRESS_${usernameEnvVar}\` and \`CYPRESS_${passwordEnvVar}\` environment variables`
-  );
-
-  loginWithUsernameAndPassword(username, password);
-};
-
-/**
- * Authenticates with Kibana by reading credentials from the
- * `kibana.dev.yml` file and POSTing the username and password directly to
- * Kibana's `/internal/security/login` endpoint, bypassing the login page (for speed).
- */
-const loginViaConfig = () => {
-  cy.log(
-    `Authenticating via config credentials \`${ELASTICSEARCH_USERNAME_CONFIG_PATH}\` and \`${ELASTICSEARCH_PASSWORD_CONFIG_PATH}\` from \`${KIBANA_DEV_YML_PATH}\``
-  );
-
-  // read the login details from `kibana.dev.yaml`
-  cy.readFile(KIBANA_DEV_YML_PATH).then((kibanaDevYml) => {
-    const config = yaml.safeLoad(kibanaDevYml);
-    loginWithUsernameAndPassword(
-      Cypress.env(ELASTICSEARCH_USERNAME),
-      config.elasticsearch.password
-    );
-  });
-};
-
-export const getRoleWithArtifactReadPrivilege = (privilegePrefix: string) => {
-  const endpointSecurityPolicyManagerRole = getEndpointSecurityPolicyManager();
-
-  return {
-    ...endpointSecurityPolicyManagerRole,
-    kibana: [
-      {
-        ...endpointSecurityPolicyManagerRole.kibana[0],
-        feature: {
-          ...endpointSecurityPolicyManagerRole.kibana[0].feature,
-          siem: [
-            ...endpointSecurityPolicyManagerRole.kibana[0].feature.siem.filter(
-              (privilege) => privilege !== `${privilegePrefix}all`
-            ),
-            `${privilegePrefix}read`,
-          ],
-        },
-      },
-    ],
-  };
+    })
+    .then(() => ({ username, password }));
 };
diff --git a/x-pack/plugins/security_solution/public/management/cypress/tasks/login_serverless.ts b/x-pack/plugins/security_solution/public/management/cypress/tasks/login_serverless.ts
deleted file mode 100644
index 533a17663e16b..0000000000000
--- a/x-pack/plugins/security_solution/public/management/cypress/tasks/login_serverless.ts
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type { LoginState } from '@kbn/security-plugin/common/login_state';
-import { COMMON_API_HEADERS, request } from './common';
-
-export enum ServerlessUser {
-  T1_ANALYST = 't1_analyst',
-  T2_ANALYST = 't2_analyst',
-  T3_ANALYST = 't3_analyst',
-  THREAT_INTELLIGENCE_ANALYST = 'threat_intelligence_analyst',
-  RULE_AUTHOR = 'rule_author',
-  SOC_MANAGER = 'soc_manager',
-  DETECTIONS_ADMIN = 'detections_admin',
-  PLATFORM_ENGINEER = 'platform_engineer',
-  ENDPOINT_OPERATIONS_ANALYST = 'endpoint_operations_analyst',
-  ENDPOINT_POLICY_MANAGER = 'endpoint_policy_manager',
-}
-
-/**
- * Send login via API
- * @param username
- * @param password
- *
- * @private
- */
-const sendApiLoginRequest = (
-  username: string,
-  password: string
-): Cypress.Chainable<{ username: string; password: string }> => {
-  const baseUrl = Cypress.config().baseUrl;
-  const headers = { ...COMMON_API_HEADERS };
-
-  cy.log(`Authenticating [${username}] via ${baseUrl}`);
-
-  return request<LoginState>({ headers, url: `${baseUrl}/internal/security/login_state` })
-    .then((loginState) => {
-      const basicProvider = loginState.body.selector.providers.find(
-        (provider) => provider.type === 'basic'
-      );
-
-      return request({
-        url: `${baseUrl}/internal/security/login`,
-        method: 'POST',
-        headers,
-        body: {
-          providerType: basicProvider?.type,
-          providerName: basicProvider?.name,
-          currentURL: '/',
-          params: { username, password },
-        },
-      });
-    })
-    .then(() => ({ username, password }));
-};
-
-interface CyLoginTask {
-  (user?: ServerlessUser | 'elastic'): ReturnType<typeof sendApiLoginRequest>;
-
-  /**
-   * Login using any username/password
-   * @param username
-   * @param password
-   */
-  with(username: string, password: string): ReturnType<typeof sendApiLoginRequest>;
-}
-
-/**
- * Login to Kibana using API (not login page). By default, user will be logged in using
- * the username and password defined via `KIBANA_USERNAME` and `KIBANA_PASSWORD` cypress env
- * variables.
- * @param user Defaults to `soc_manager`
- */
-export const loginServerless: CyLoginTask = (
-  user: ServerlessUser | 'elastic' = ServerlessUser.SOC_MANAGER
-): ReturnType<typeof sendApiLoginRequest> => {
-  const username = Cypress.env('KIBANA_USERNAME');
-  const password = Cypress.env('KIBANA_PASSWORD');
-
-  if (user && user !== 'elastic') {
-    throw new Error('Serverless usernames not yet implemented');
-
-    // return cy.task('loadUserAndRole', { name: user }).then((loadedUser) => {
-    //   username = loadedUser.username;
-    //   password = loadedUser.password;
-    //
-    //   return sendApiLoginRequest(username, password);
-    // });
-  } else {
-    return sendApiLoginRequest(username, password);
-  }
-};
-
-loginServerless.with = (
-  username: string,
-  password: string
-): ReturnType<typeof sendApiLoginRequest> => {
-  return sendApiLoginRequest(username, password);
-};
diff --git a/x-pack/plugins/security_solution/public/management/cypress/tsconfig.json b/x-pack/plugins/security_solution/public/management/cypress/tsconfig.json
index 4d7fe47ec2d23..94d50ffe7f62a 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/tsconfig.json
+++ b/x-pack/plugins/security_solution/public/management/cypress/tsconfig.json
@@ -32,5 +32,6 @@
     "@kbn/test",
     "@kbn/repo-info",
     "@kbn/data-views-plugin",
+    "@kbn/tooling-log",
   ]
 }
diff --git a/x-pack/plugins/security_solution/public/management/cypress/types.ts b/x-pack/plugins/security_solution/public/management/cypress/types.ts
index fecaa33a6a70a..aee97723c7d51 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/types.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/types.ts
@@ -7,8 +7,10 @@
 
 /* eslint-disable @typescript-eslint/no-explicit-any */
 
+import type { Role } from '@kbn/security-plugin/common';
 import type { ActionDetails } from '../../../common/endpoint/types';
 import type { CyLoadEndpointDataOptions } from './support/plugin_handlers/endpoint_data_loader';
+import type { SecurityTestUser } from './common/constants';
 
 type PossibleChainable =
   | Cypress.Chainable<any>
@@ -56,3 +58,11 @@ export interface HostActionResponse {
     state: { state?: 'success' | 'failure' };
   };
 }
+
+export interface LoadUserAndRoleCyTaskOptions {
+  name: SecurityTestUser;
+}
+
+export interface CreateUserAndRoleCyTaskOptions {
+  role: Role;
+}
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/common/constants.ts b/x-pack/plugins/security_solution/scripts/endpoint/common/constants.ts
index 1d2b3d5f47784..4a8b2daca2af4 100644
--- a/x-pack/plugins/security_solution/scripts/endpoint/common/constants.ts
+++ b/x-pack/plugins/security_solution/scripts/endpoint/common/constants.ts
@@ -10,3 +10,8 @@ export const HORIZONTAL_LINE = '-'.repeat(80);
 export const ENDPOINT_EVENTS_INDEX = 'logs-endpoint.events.process-default';
 
 export const ENDPOINT_ALERTS_INDEX = 'logs-endpoint.alerts-default';
+
+export const COMMON_API_HEADERS = Object.freeze({
+  'kbn-xsrf': 'security-solution',
+  'x-elastic-internal-origin': 'security-solution',
+});
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/common/role_and_user_loader.ts b/x-pack/plugins/security_solution/scripts/endpoint/common/role_and_user_loader.ts
new file mode 100644
index 0000000000000..f8c51d5255018
--- /dev/null
+++ b/x-pack/plugins/security_solution/scripts/endpoint/common/role_and_user_loader.ts
@@ -0,0 +1,175 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/* eslint-disable max-classes-per-file */
+
+import type { KbnClient } from '@kbn/test';
+import type { Role } from '@kbn/security-plugin/common';
+import type { ToolingLog } from '@kbn/tooling-log';
+import { inspect } from 'util';
+import type { AxiosError } from 'axios';
+import type { EndpointSecurityRoleDefinitions } from './roles_users';
+import { getAllEndpointSecurityRoles } from './roles_users';
+import { catchAxiosErrorFormatAndThrow } from './format_axios_error';
+import { COMMON_API_HEADERS } from './constants';
+
+const ignoreHttp409Error = (error: AxiosError) => {
+  if (error?.response?.status === 409) {
+    return;
+  }
+
+  throw error;
+};
+
+export interface LoadedRoleAndUser {
+  role: string;
+  username: string;
+  password: string;
+}
+
+export interface RoleAndUserLoaderInterface<R extends Record<string, Role> = Record<string, Role>> {
+  /**
+   * Loads the requested Role into kibana and then creates a user by the same role name that is
+   * assigned to the given role
+   * @param name
+   */
+  load(name: keyof R): Promise<LoadedRoleAndUser>;
+
+  /**
+   * Loads all roles/users
+   */
+  loadAll(): Promise<Record<keyof R, LoadedRoleAndUser>>;
+
+  /**
+   * Creates a new Role in kibana along with a user (by the same name as the Role name)
+   * that is assigned to the given role
+   * @param role
+   */
+  create(role: Role): Promise<LoadedRoleAndUser>;
+}
+
+/**
+ * A generic class for loading roles and creating associated user into kibana
+ */
+export class RoleAndUserLoader<R extends Record<string, Role> = Record<string, Role>>
+  implements RoleAndUserLoaderInterface<R>
+{
+  protected readonly logPromiseError: (error: Error) => never;
+
+  constructor(
+    protected readonly kbnClient: KbnClient,
+    protected readonly logger: ToolingLog,
+    protected readonly roles: R
+  ) {
+    this.logPromiseError = (error) => {
+      this.logger.error(inspect(error, { depth: 5 }));
+      throw error;
+    };
+  }
+
+  async load(name: keyof R): Promise<LoadedRoleAndUser> {
+    const role = this.roles[name];
+
+    if (!role) {
+      throw new Error(
+        `Unknown role/user: [${String(name)}]. Valid values are: [${Object.keys(this.roles).join(
+          ', '
+        )}]`
+      );
+    }
+
+    return this.create(role);
+  }
+
+  async loadAll(): Promise<Record<keyof R, LoadedRoleAndUser>> {
+    const response = {} as Record<keyof R, LoadedRoleAndUser>;
+
+    for (const [name, role] of Object.entries(this.roles)) {
+      response[name as keyof R] = await this.create(role);
+    }
+
+    return response;
+  }
+
+  public async create(role: Role): Promise<LoadedRoleAndUser> {
+    const roleName = role.name;
+
+    await this.createRole(role);
+    await this.createUser(roleName, 'changeme', [roleName]);
+
+    return {
+      role: roleName,
+      username: roleName,
+      password: 'changeme',
+    };
+  }
+
+  protected async createRole(role: Role): Promise<void> {
+    const { name: roleName, ...roleDefinition } = role;
+
+    this.logger.debug(`creating role:`, roleDefinition);
+
+    await this.kbnClient
+      .request({
+        method: 'PUT',
+        path: `/api/security/role/${roleName}`,
+        headers: {
+          ...COMMON_API_HEADERS,
+        },
+        body: roleDefinition,
+      })
+      .then((response) => {
+        this.logger.debug(`Role [${roleName}] created/updated`, response?.data);
+        return response;
+      })
+      .catch(ignoreHttp409Error)
+      .catch(catchAxiosErrorFormatAndThrow)
+      .catch(this.logPromiseError);
+  }
+
+  protected async createUser(
+    username: string,
+    password: string,
+    roles: string[] = []
+  ): Promise<void> {
+    const user = {
+      username,
+      password,
+      roles,
+      full_name: username,
+      email: '',
+    };
+
+    this.logger.debug(`creating user:`, user);
+
+    await this.kbnClient
+      .request({
+        method: 'POST',
+        path: `/internal/security/users/${username}`,
+        headers: {
+          ...COMMON_API_HEADERS,
+        },
+        body: user,
+      })
+      .then((response) => {
+        this.logger.debug(`User [${username}] created/updated`, response?.data);
+        return response;
+      })
+      .catch(ignoreHttp409Error)
+      .catch(catchAxiosErrorFormatAndThrow)
+      .catch(this.logPromiseError);
+  }
+}
+
+/**
+ * Role and user loader for Endpoint security dev/testing
+ */
+export class EndpointSecurityTestRolesLoader extends RoleAndUserLoader<EndpointSecurityRoleDefinitions> {
+  constructor(protected readonly kbnClient: KbnClient, protected readonly logger: ToolingLog) {
+    super(kbnClient, logger, getAllEndpointSecurityRoles());
+  }
+}
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/common/roles_users/index.ts b/x-pack/plugins/security_solution/scripts/endpoint/common/roles_users/index.ts
new file mode 100644
index 0000000000000..b035f55bf1589
--- /dev/null
+++ b/x-pack/plugins/security_solution/scripts/endpoint/common/roles_users/index.ts
@@ -0,0 +1,139 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { Role } from '@kbn/security-plugin/common';
+import { getRuleAuthor } from './rule_author';
+import { getT3Analyst } from './t3_analyst';
+import { getT1Analyst } from './t1_analyst';
+import { getT2Analyst } from './t2_analyst';
+import { getHunter } from './hunter';
+import { getThreatIntelligenceAnalyst } from './threat_intelligence_analyst';
+import { getSocManager } from './soc_manager';
+import { getPlatformEngineer } from './platform_engineer';
+import { getEndpointOperationsAnalyst } from './endpoint_operations_analyst';
+import {
+  getEndpointSecurityPolicyManagementReadRole,
+  getEndpointSecurityPolicyManager,
+} from './endpoint_security_policy_manager';
+import { getDetectionsEngineer } from './detections_engineer';
+import { getWithResponseActionsRole } from './with_response_actions_role';
+import { getNoResponseActionsRole } from './without_response_actions_role';
+
+export * from './with_response_actions_role';
+export * from './without_response_actions_role';
+export * from './t1_analyst';
+export * from './t2_analyst';
+export * from './t3_analyst';
+export * from './hunter';
+export * from './threat_intelligence_analyst';
+export * from './soc_manager';
+export * from './platform_engineer';
+export * from './endpoint_operations_analyst';
+export * from './endpoint_security_policy_manager';
+export * from './detections_engineer';
+
+export type EndpointSecurityRoleNames = keyof typeof ENDPOINT_SECURITY_ROLE_NAMES;
+
+export type EndpointSecurityRoleDefinitions = Record<EndpointSecurityRoleNames, Role>;
+
+/**
+ * Security Solution set of roles that are loaded and used in serverless deployments.
+ * The source of these role definitions is under `project-controller` at:
+ *
+ * @see https://github.com/elastic/project-controller/blob/main/internal/project/security/config/roles.yml
+ *
+ * The role definition spreadsheet can be found here:
+ *
+ * @see https://docs.google.com/spreadsheets/d/16aGow187AunLCBFZLlbVyS81iQNuMpNxd96LOerWj4c/edit#gid=1936689222
+ */
+export const SECURITY_SERVERLESS_ROLE_NAMES = Object.freeze({
+  t1_analyst: 't1_analyst',
+  t2_analyst: 't2_analyst',
+  t3_analyst: 't3_analyst',
+  threat_intelligence_analyst: 'threat_intelligence_analyst',
+  rule_author: 'rule_author',
+  soc_manager: 'soc_manager',
+  detections_admin: 'detections_admin',
+  platform_engineer: 'platform_engineer',
+  endpoint_operations_analyst: 'endpoint_operations_analyst',
+  endpoint_policy_manager: 'endpoint_policy_manager',
+});
+
+export const ENDPOINT_SECURITY_ROLE_NAMES = Object.freeze({
+  // --------------------------------------
+  // Set of roles used in serverless
+  ...SECURITY_SERVERLESS_ROLE_NAMES,
+
+  // --------------------------------------
+  // Other roles used for testing
+  hunter: 'hunter',
+  endpoint_response_actions_access: 'endpoint_response_actions_access',
+  endpoint_response_actions_no_access: 'endpoint_response_actions_no_access',
+  endpoint_security_policy_management_read: 'endpoint_security_policy_management_read',
+});
+
+export const getAllEndpointSecurityRoles = (): EndpointSecurityRoleDefinitions => {
+  return {
+    t1_analyst: {
+      ...getT1Analyst(),
+      name: 't1_analyst',
+    },
+    t2_analyst: {
+      ...getT2Analyst(),
+      name: 't2_analyst',
+    },
+    t3_analyst: {
+      ...getT3Analyst(),
+      name: 't3_analyst',
+    },
+    threat_intelligence_analyst: {
+      ...getThreatIntelligenceAnalyst(),
+      name: 'threat_intelligence_analyst',
+    },
+    rule_author: {
+      ...getRuleAuthor(),
+      name: 'rule_author',
+    },
+    soc_manager: {
+      ...getSocManager(),
+      name: 'soc_manager',
+    },
+    detections_admin: {
+      ...getDetectionsEngineer(),
+      name: 'detections_admin',
+    },
+    platform_engineer: {
+      ...getPlatformEngineer(),
+      name: 'platform_engineer',
+    },
+    endpoint_operations_analyst: {
+      ...getEndpointOperationsAnalyst(),
+      name: 'endpoint_operations_analyst',
+    },
+    endpoint_policy_manager: {
+      ...getEndpointSecurityPolicyManager(),
+      name: 'endpoint_policy_manager',
+    },
+
+    hunter: {
+      ...getHunter(),
+      name: 'hunter',
+    },
+    endpoint_response_actions_access: {
+      ...getWithResponseActionsRole(),
+      name: 'endpoint_response_actions_access',
+    },
+    endpoint_response_actions_no_access: {
+      ...getNoResponseActionsRole(),
+      name: 'endpoint_response_actions_no_access',
+    },
+    endpoint_security_policy_management_read: {
+      ...getEndpointSecurityPolicyManagementReadRole(),
+      name: 'endpoint_security_policy_management_read',
+    },
+  };
+};
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/common/roles_users/rule_author.ts b/x-pack/plugins/security_solution/scripts/endpoint/common/roles_users/rule_author.ts
new file mode 100644
index 0000000000000..f957fe8947c5d
--- /dev/null
+++ b/x-pack/plugins/security_solution/scripts/endpoint/common/roles_users/rule_author.ts
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { Role } from '@kbn/security-plugin/common';
+import { getNoResponseActionsRole } from './without_response_actions_role';
+
+export const getRuleAuthor: () => Omit<Role, 'name'> = () => {
+  const noResponseActionsRole = getNoResponseActionsRole();
+  return {
+    ...noResponseActionsRole,
+    kibana: [
+      {
+        ...noResponseActionsRole.kibana[0],
+        feature: {
+          ...noResponseActionsRole.kibana[0].feature,
+          siem: [
+            'all',
+            'read_alerts',
+            'crud_alerts',
+            'policy_management_all',
+            'endpoint_list_all',
+            'trusted_applications_all',
+            'event_filters_all',
+            'host_isolation_exceptions_read',
+            'blocklist_all',
+            'actions_log_management_read',
+          ],
+        },
+      },
+    ],
+  };
+};
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/common/roles_users/t3_analyst.ts b/x-pack/plugins/security_solution/scripts/endpoint/common/roles_users/t3_analyst.ts
new file mode 100644
index 0000000000000..304c4e6d744ee
--- /dev/null
+++ b/x-pack/plugins/security_solution/scripts/endpoint/common/roles_users/t3_analyst.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { Role } from '@kbn/security-plugin/common';
+import { getNoResponseActionsRole } from './without_response_actions_role';
+
+export const getT3Analyst: () => Omit<Role, 'name'> = () => {
+  const noResponseActionsRole = getNoResponseActionsRole();
+  return {
+    ...noResponseActionsRole,
+    kibana: [
+      {
+        ...noResponseActionsRole.kibana[0],
+        feature: {
+          ...noResponseActionsRole.kibana[0].feature,
+          siem: [
+            'all',
+            'read_alerts',
+            'crud_alerts',
+            'endpoint_list_all',
+            'trusted_applications_all',
+            'event_filters_all',
+            'host_isolation_exceptions_all',
+            'blocklist_all',
+            'policy_management_read',
+            'host_isolation_all',
+            'process_operations_all',
+            'actions_log_management_all',
+            'file_operations_all',
+          ],
+        },
+      },
+    ],
+  };
+};
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/resolver_generator_script.ts b/x-pack/plugins/security_solution/scripts/endpoint/resolver_generator_script.ts
index c1c38dcf8b30a..330bcf4589a74 100644
--- a/x-pack/plugins/security_solution/scripts/endpoint/resolver_generator_script.ts
+++ b/x-pack/plugins/security_solution/scripts/endpoint/resolver_generator_script.ts
@@ -14,36 +14,13 @@ import { CA_CERT_PATH } from '@kbn/dev-utils';
 import { ToolingLog } from '@kbn/tooling-log';
 import type { KbnClientOptions } from '@kbn/test';
 import { KbnClient } from '@kbn/test';
-import type { Role } from '@kbn/security-plugin/common';
+import { EndpointSecurityTestRolesLoader } from './common/role_and_user_loader';
 import { METADATA_DATASTREAM } from '../../common/endpoint/constants';
 import { EndpointMetadataGenerator } from '../../common/endpoint/data_generators/endpoint_metadata_generator';
 import { indexHostsAndAlerts } from '../../common/endpoint/index_data';
 import { ANCESTRY_LIMIT, EndpointDocGenerator } from '../../common/endpoint/generate_data';
 import { fetchStackVersion, isServerlessKibanaFlavor } from './common/stack_services';
 import { ENDPOINT_ALERTS_INDEX, ENDPOINT_EVENTS_INDEX } from './common/constants';
-import { getWithResponseActionsRole } from './common/roles_users/with_response_actions_role';
-import { getNoResponseActionsRole } from './common/roles_users/without_response_actions_role';
-import { getT1Analyst } from './common/roles_users/t1_analyst';
-import { getT2Analyst } from './common/roles_users/t2_analyst';
-import { getEndpointOperationsAnalyst } from './common/roles_users/endpoint_operations_analyst';
-import { getEndpointSecurityPolicyManager } from './common/roles_users/endpoint_security_policy_manager';
-import { getHunter } from './common/roles_users/hunter';
-import { getPlatformEngineer } from './common/roles_users/platform_engineer';
-import { getSocManager } from './common/roles_users/soc_manager';
-import { getThreatIntelligenceAnalyst } from './common/roles_users/threat_intelligence_analyst';
-
-const rolesMapping: { [id: string]: Omit<Role, 'name'> } = {
-  t1Analyst: getT1Analyst(),
-  t2Analyst: getT2Analyst(),
-  hunter: getHunter(),
-  threatIntelligenceAnalyst: getThreatIntelligenceAnalyst(),
-  socManager: getSocManager(),
-  platformEngineer: getPlatformEngineer(),
-  endpointOperationsAnalyst: getEndpointOperationsAnalyst(),
-  endpointSecurityPolicyManager: getEndpointSecurityPolicyManager(),
-  withResponseActionsRole: getWithResponseActionsRole(),
-  noResponseActionsRole: getNoResponseActionsRole(),
-};
 
 main();
 
@@ -67,31 +44,6 @@ async function deleteIndices(indices: string[], client: Client) {
   }
 }
 
-async function addRole(kbnClient: KbnClient, role: Role): Promise<string | undefined> {
-  if (!role) {
-    console.log('No role data given');
-    return;
-  }
-
-  const { name, ...permissions } = role;
-  const path = `/api/security/role/${name}?createOnly=true`;
-
-  // add role if doesn't exist already
-  try {
-    console.log(`Adding ${name} role`);
-    await kbnClient.request({
-      method: 'PUT',
-      path,
-      body: permissions,
-    });
-
-    return name;
-  } catch (error) {
-    console.log(error);
-    handleErr(error);
-  }
-}
-
 interface UserInfo {
   username: string;
   password: string;
@@ -422,19 +374,7 @@ async function main() {
       throw new Error(`Can not use '--rbacUser' option against serverless deployment`);
     }
 
-    // Add roles and users with response actions kibana privileges
-    for (const role of Object.keys(rolesMapping)) {
-      const addedRole = await addRole(kbnClient, {
-        name: role,
-        ...rolesMapping[role],
-      });
-      if (addedRole) {
-        logger.info(`Successfully added ${role} role`);
-        await addUser(client, { username: role, password: 'changeme', roles: [role] });
-      } else {
-        logger.warning(`Failed to add role, ${role}`);
-      }
-    }
+    await loadRbacTestUsers(kbnClient, logger);
   }
 
   const seed = argv.seed || Math.random().toString();
@@ -499,3 +439,12 @@ async function main() {
 
   logger.info(`Creating and indexing documents took: ${new Date().getTime() - startTime}ms`);
 }
+
+const loadRbacTestUsers = async (kbnClient: KbnClient, logger: ToolingLog): Promise<void> => {
+  const loadedRoles = await new EndpointSecurityTestRolesLoader(kbnClient, logger).loadAll();
+
+  logger.info(`Roles and associated users loaded. Login accounts:
+  ${Object.values(loadedRoles)
+    .map(({ username, password }) => `${username} / ${password}`)
+    .join('\n  ')}`);
+};