TS/SCI Splunk SOAR Engineer - Threat Automation Expert

Leidos; Suitland (MD); On-site; USD 108,000 - 195,000; Full time

Job summary

Leidos in Suitland, MD is seeking a Splunk SOAR Engineer to provide engineering, operations, and technical support for SIEM platforms serving threat detection and incident management for the HGCC. You will design, deploy, and maintain backend architecture and administer the SOAR platform with integrations and playbooks.

The role requires active TS/SCI clearance, 8+ years in CND engineering, and 6+ years with Splunk including Enterprise Security and SOAR.

Qualifications

• Active TS/SCI security clearance.
• 8+ years in engineering for Computer Network Defense (CND).
• 6+ years with Splunk and related tools.
• Master's/Bachelor's degree as stated.
• Strong analytical and problem-solving skills.

Responsibilities

• Design, deploy, and maintain backend architecture.
• Administer the SOAR platform and integrations.
• Develop automated SOAR playbooks for alert triage and response.
• Integrate SOAR with Splunk ES, tickets, and threat feeds.
• Manage clustering, indexing performance, and license usage.
• Apply DISA STIGs, SRGs, and NAVINTEL baselines.
• Maintain version control, workflows, and playbook governance.
• Configure secure transmission of Audit.XML to IC partners.
• Implement incident response workflows aligned with MITRE ATT&CK and NIST 800-61.
• Travel between NMIC and CONUS/OCONUS locations as needed.

Skills

TS/SCI clearance

Splunk expertise

IAT Level III cert

Splunk Enterprise Security

Splunk SOAR

CND engineering experience

SDLC

Analytical skills

Communication skills

Network defense experience

Education

Bachelor's degree in Computer Science/Information Technology/Information Assurance

Master's degree (preferred) with 6+ years experience

15+ years experience in lieu of degree in LAN/WAN

Tools

Splunk

Splunk Add-ons

Splunk Apps

Technology Add-ons (TAs)

Universal Forwarder

Job description

Leidos in Suitland, MD is seeking a Splunk SOAR Engineer to provide engineering, operations, and technical support for SIEM platforms serving threat detection and incident management for the HGCC. You will design, deploy, and maintain backend architecture and administer the SOAR platform with integrations and playbooks.

The role requires active TS/SCI clearance, 8+ years in CND engineering, and 6+ years with Splunk including Enterprise Security and SOAR.