Splunk Enterprise & Enterprise Security Admin (TS/SCI)

Leidos; Suitland (MD); On-site; USD 108,000 - 195,000; Full time

Job summary

Leidos is seeking a Splunk Enterprise and Enterprise Security Administrator in Suitland, MD to maintain the NAVINTEL SIEM environment, engineer detection logic, develop dashboards, and support SOC operations.

The ideal candidate has active TS/SCI clearance, deep Splunk expertise, and a track record of incident response, threat hunting, and RMF-aligned configuration. This role requires collaboration with cybersecurity teams to strengthen defensive capabilities.

Qualifications

• Bachelor’s degree in CS/IT/IA with 8+ years experience or Master’s with 6+ years.
• Active TS/SCI security clearance.
• Demonstrated experience supporting Computer Network Defense (CND) operations and technologies.
• 6+ years professional experience in Splunk, Splunk Add-ons and Apps, and Splunk TA and Universal Forwarder installation, integration, configuration, administration, maintenance, and performance of RMF functions.
• Deep experience with Splunk Enterprise/ES, search processing language (SPL), CIM mapping, dashboards, and Linux administration.
• Experience supporting SOC workflows and SIEM tuning.

Responsibilities

• Administer Splunk Enterprise, Enterprise Security, CIM compliance, correlation searches, RBAs, dashboards, and data models.
• Onboard new data sources and ensure quality, parsing, and normalization.
• Support incident response, threat hunting, detection engineering, and content governance.
• Produce operational reports, posture summaries, dashboards, and detection documentation.

Skills

SPL

Threat hunting

Incident response

SOC workflows

Linux admin

Education

Bachelor’s degree in CS/IT/IA

Master’s degree in CS/IT/IA

Tools

Splunk Enterprise

Splunk Enterprise Security

Splunk CIM

Splunk TA & UF

Linux administration

Job description

Leidos is seeking a Splunk Enterprise and Enterprise Security Administrator in Suitland, MD to maintain the NAVINTEL SIEM environment, engineer detection logic, develop dashboards, and support SOC operations.

The ideal candidate has active TS/SCI clearance, deep Splunk expertise, and a track record of incident response, threat hunting, and RMF-aligned configuration. This role requires collaboration with cybersecurity teams to strengthen defensive capabilities.