TS/SCI Splunk SOAR Administrator — Mission‑Critical Ops

Leidos Inc; Suitland (MD); On-site; USD 108,000 - 195,000; Full time

Job summary

Leidos is recruiting a Splunk SOAR Administrator to join our Suitland, MD team. You will provide engineering, operations, and technical support for SIEM platforms supporting threat detection, compliance, and incident management for HGCC.

You will design, deploy, and automate security operations, integrate with Splunk ES and threat feeds, and implement incident response workflows aligned with MITRE ATT&CK and NIST guidance.

Qualifications

• Bachelor's degree in CS/IT or related field with 8+ years of experience.
• Active TS/SCI security clearance.
• Active IAT Level III certification (e.g., CISSP).
• 8+ years of engineering experience supporting CND.
• 6+ years of experience with Splunk and add-ons/TA/UF.
• Expert knowledge of Splunk components (ES, UBA).
• Experience with SDLC and security operations.
• Strong analytical and problem-solving skills.
• Effective verbal and written communication.
• Experience integrating security tools and incident response workflows.

Responsibilities

• Design, deploy, and maintain EAC backend architecture.
• Administer the SOAR platform: configuration, integrations, and fields.
• Develop and maintain automated SOAR playbooks for alert triage and response.
• Integrate SOAR with Splunk ES, tickets, and threat feeds.
• Manage clustering, replication, indexing performance, and licenses.
• Apply DISA STIGs, SRGs, NAVINTEL baselines.
• Maintain version control and governance of playbooks.
• Configure secure transmission of Audit.XML to IC partners.
• Implement MITRE ATT&CK and NIST-aligned incident workflows.
• Travel may be required to NMIC and CONUS/OCONUS locations.

Skills

Analytical skills

Communication skills

Team collaboration

Education

Bachelor's degree in CS/IT or related

Tools

Splunk Enterprise

Splunk Enterprise Security

Splunk SOAR

Job description

Leidos is recruiting a Splunk SOAR Administrator to join our Suitland, MD team. You will provide engineering, operations, and technical support for SIEM platforms supporting threat detection, compliance, and incident management for HGCC.

You will design, deploy, and automate security operations, integrate with Splunk ES and threat feeds, and implement incident response workflows aligned with MITRE ATT&CK and NIST guidance.