Senior Splunk ES Admin — TS/SCI SIEM & SOC

Leidos; Suitland (MD); On-site; USD 108,000 - 195,000; Full time

Job summary

Leidos is seeking a Splunk Enterprise and Enterprise Security Administrator to maintain the NAVINTEL SIEM environment, engineer detection logic, develop dashboards, and support SOC operations from Suitland, MD. The role requires an Active TS/SCI clearance and deep Splunk expertise, including SPL, CIM, and RMF-aligned practices.

Responsibilities include onboarding data sources, threat hunting support, and producing dashboards and reports that describe system posture.

Qualifications

• Bachelor’s degree in CS, IT, IA or related area with 8+ years of experience or a Master’s degree with 6+ years of experience.
• Active TS/SCI security clearance.
• 6+ years professional experience in Splunk, Splunk Add-ons and Apps, and Splunk TA and Universal Forwarder installation, integration, configuration, administration, maintenance, and performance of RMF functions.
• Deep experience with Splunk Enterprise/ES, search processing language (SPL), CIM mapping, dashboards, and Linux administration.
• Experience supporting SOC workflows and SIEM tuning.

Responsibilities

• Administer Splunk Enterprise, Enterprise Security, CIM compliance, correlation searches, RBAs, dashboards, and data models.
• Onboard new data sources and ensure quality, parsing, and normalization.
• Support incident response, threat hunting, detection engineering, and content governance.
• Produce operational reports, posture summaries, dashboards, and detection documentation.

Skills

Splunk

SPL

CIM mapping

Linux administration

SOC workflows

Active TS/SCI clearance

Threat detection engineering

Education

Bachelor’s degree in CS/IT/IA or related

Master’s degree in related area

Tools

Splunk Add-ons

Splunk Apps

Splunk TA

RMF functions

Job description

Leidos is seeking a Splunk Enterprise and Enterprise Security Administrator to maintain the NAVINTEL SIEM environment, engineer detection logic, develop dashboards, and support SOC operations from Suitland, MD. The role requires an Active TS/SCI clearance and deep Splunk expertise, including SPL, CIM, and RMF-aligned practices.

Responsibilities include onboarding data sources, threat hunting support, and producing dashboards and reports that describe system posture.