Splunk SOAR Engineer | TS/SCI Clearance

Leidos; Suitland (MD); On-site; USD 108,000 - 195,000; Full time

Job summary

Leidos is seeking a Splunk SOAR Administrator in Suitland, MD to provide engineering, operations, and technical support for SIEM platforms supporting threat detection and incident management for the HGCC program.

You will design, deploy, and maintain SOAR playbooks, integrate with Splunk ES and ticketing systems, and ensure secure transmission of Audit.XML records. Active TS/SCI and CISSP-type certification are required.

Qualifications

• 8+ years of engineering experience supporting Computer Network Defense (CND).
• Active TS/SCI security clearance.
• Active IAT Level III certification (e.g., CISSP).
• 6+ years of experience with Splunk, including Add-ons, Apps, TAs, and Universal Forwarder.
• Expert knowledge of Splunk, including Splunk Enterprise, Splunk Enterprise Security, and Splunk SOAR.

Responsibilities

• Design, deploy, and maintain EAC backend architecture.
• Administer the SOAR platform, including configuration, asset integrations, and custom fields.
• Design, develop, test, and maintain automated SOAR playbooks for alert triage, enrichment, and risk based response.
• Integrate SOAR with Splunk Enterprise Security, ticketing systems, and threat intelligence feeds.
• Manage clustering, replication, indexing performance, and license usage.
• Apply DISA STIGs, SRGs, and NAVINTEL Information Assurance baselines.
• Maintain version control, approval workflows, and playbook governance.
• Configure and maintain the secure transmission of Audit.XML records to Intelligence Community partners through ITS and troubleshoot transmission failures.
• Implement standard incident response workflows aligned with MITRE ATT&CK, NIST SP 800-61, and HGCC N62 Defensive Cyber Operations procedures.
• Travel may be required between NMIC and other CONUS/OCONUS locations.

Skills

Splunk Enterprise

Splunk Enterprise Security

Splunk SOAR

Security Clearance TS/SCI

IAT Level III (CISSP)

Threat detection & incident response

SDLC

Verbal & written communication

Education

Bachelor's degree in Computer Science / IT / Information Assurance

Master's degree in related field

Tools

Splunk Add-ons

Splunk Apps

Splunk Technology Add-ons (TAs)

Splunk Universal Forwarder

Job description

Leidos is seeking a Splunk SOAR Administrator in Suitland, MD to provide engineering, operations, and technical support for SIEM platforms supporting threat detection and incident management for the HGCC program.

You will design, deploy, and maintain SOAR playbooks, integrate with Splunk ES and ticketing systems, and ensure secure transmission of Audit.XML records. Active TS/SCI and CISSP-type certification are required.