Senior Splunk SOAR Administrator TS/SCI

Via Logic LLC; Suitland (MD); On-site; USD 108,000 - 195,000; Full time

Job summary

Leidos is seeking a Splunk SOAR Administrator to join our team in Suitland, MD. You will provide engineering, operations, and technical support for SIEM platforms that support threat detection, compliance, and security incident management for the HGCC.

The role emphasizes designing, deploying, and maintaining SOAR backends; administering the SOAR platform; developing automated playbooks; and integrating with Splunk ES, ticketing systems, and threat feeds.

Qualifications

• Active TS/SCI clearance is required.
• 8+ years of engineering experience supporting Computer Network Defense (CND).
• 6+ years of experience with Splunk, including Splunk Add-ons, Apps, Technology Add-ons (TAs), and Universal Forwarder.
• Expert knowledge of Splunk Enterprise, Splunk Enterprise Security, and Splunk SOAR.
• Significant experience with SDLC and strong analytical/problem-solving skills.

Responsibilities

• Design, deploy, and maintain backend architecture for EAC.
• Administer the SOAR platform, including configuration and integrations.
• Develop and maintain automated SOAR playbooks for alert triage and response.
• Integrate SOAR with Splunk ES, ticketing systems, and threat feeds.
• Manage clustering, replication, indexing performance, and license usage.
• Apply DISA STIGs and NAVINTEL IA baselines.
• Maintain version control, approval workflows, and playbook governance.
• Configure secure transmission of Audit.XML records to partners and troubleshoot transmissions.
• Implement incident response workflows aligned with MITRE ATT&CK, NIST SP 800-61, and HGCC procedures.
• Travel may be required between NMIC and other CONUS/OCONUS locations.

Skills

Analytical skills

Communication skills

Problem solving

Education

Bachelor's degree in CS/IT/IA or related field

Master's degree in related field

Tools

Splunk

Job description

Leidos is seeking a Splunk SOAR Administrator to join our team in Suitland, MD. You will provide engineering, operations, and technical support for SIEM platforms that support threat detection, compliance, and security incident management for the HGCC.

The role emphasizes designing, deploying, and maintaining SOAR backends; administering the SOAR platform; developing automated playbooks; and integrating with Splunk ES, ticketing systems, and threat feeds.