Vulnerability Analysis Subject Matter Expert (SME)

Leidos Inc; Lorton (VA); On-site; USD 131,000 - 237,000; Full time

Job summary

Leidos in Lorton, VA seeks a Vulnerability Analysis Subject Matter Expert to lead vulnerability identification, analysis, and risk assessment for sensitive systems. You will translate technical findings into actionable recommendations for engineers, system owners, and senior leadership.

You will manage credentialed scanning, monitor threat intelligence, and coordinate with ISSOs/SSMs to support RMF, A&A, and continuous monitoring activities in high-security environments.

Qualifications

• Bachelor's degree in Cybersecurity, Information Assurance, Computer Science, or related discipline, or equivalent.
• Active TS/SCI clearance required.
• Progressively responsible IT cybersecurity/risk-management experience.
• Experience with enterprise vulnerability assessment and management technologies.
• Knowledge of NIST RMF, NIST SP 800-53, CNSSI, and security authorization activities.
• Ability to translate technical vulnerability information into actionable recommendations.

Responsibilities

• Perform detailed analysis of vulnerabilities affecting enterprise systems, applications, network infrastructure, operating systems, virtualization platforms, and security appliances.
• Assess vulnerability applicability and risk using CVSS, CISA KEV, EPSS, vendor advisories, and threat intelligence.
• Research emerging vulnerabilities and determine impact; recommend remediation or mitigation actions.
• Administer vulnerability tools including Tenable Security Center/Tenable.sc and Nessus.
• Develop credentialed scanning strategies and troubleshoot coverage and accuracy issues.
• Coordinate with admins and engineers to validate findings and plan remediation.

Skills

Vulnerability analysis

Risk assessment

Threat intelligence

Security architecture

OS security

Education

Bachelor's degree in Cybersecurity/Info Assurance/CS

Master's degree in Cybersecurity/Info Assurance

Tools

Tenable Security Center/Tenable.sc

Nessus

Splunk

SIEM

Endpoint security

Job description

Description

The Digital Sector at Leidos currently has an opening for a Vulnerability Analysis Subject Matter Expert (SME)to work in our Lorton, VA office.

This is an exciting opportunity to use your experience helping the Homeland Enterprise Information Technology Secure Services & Support (HEITS) Program contracted mission.

Primary Responsibilities

The Vulnerability Analysis Subject Matter Expert (SME) serves as a senior technical authority for vulnerability identification, analysis, prioritization, remediation, and risk assessment across sensitive and classified information systems.

The SME will evaluate vulnerabilities within the context of the operating environment and make defensible, risk-based determinations based on technical severity, exploitability, threat intelligence, system architecture, existing security controls, mission criticality, and potential impact.

The position requires both deep technical knowledge and cybersecurity risk-management experience. The SME must be capable of translating technical vulnerability information into actionable recommendations for engineers, system owners, cybersecurity personnel, and senior leadership.

Key Responsibilities

Perform detailed analysis of vulnerabilities affecting enterprise systems, applications, network infrastructure, operating systems, virtualization platforms, and security appliances.

Assess vulnerability applicability and actual organizational risk using CVSS, CISA KEV, EPSS, vendor advisories, available exploits, threat intelligence, system exposure, architecture, compensating controls, and mission impact.

Research emerging and zero-day vulnerabilities and determine potential impact to organizational systems; recommend appropriate remediation, mitigation, monitoring, or risk-acceptance actions.

Administer and maintain enterprise vulnerability assessment and management technologies, including Tenable Security Center/Tenable.sc, Nessus, or comparable platforms.

Develop and manage credentialed vulnerability scanning strategies and troubleshoot scan coverage, authentication, connectivity, and accuracy issues.

Monitor government, commercial, vendor, and open-source cyber threat intelligence and initiate appropriate vulnerability analysis and response activities. Identify false positives, non-applicable findings, superseded vulnerabilities, and scanner limitations requiring additional technical analysis.

Work with system administrators, engineers, ISSOs/ISSMs, and system owners to validate findings and develop practical remediation or compensating-control strategies.

Basic Qualifications

Bachelor's degree in Cybersecurity, Information Assurance, Computer Science, Information Systems, Engineering, or related discipline; or an equivalent combination of education, professional training, certifications, and relevant experience.

Active TS/SCI security clearance is required.

Significant progressively responsible experience in IT, cybersecurity, information assurance, security engineering, vulnerability management, or cyber operations.

Demonstrated experience supporting cybersecurity or risk-management activities within sensitive, classified, National Security System, DoD, Intelligence Community, or comparable high-security environments.

• Demonstrated experience with enterprise vulnerability assessment and management technologies.


• Working knowledge of NIST RMF, NIST SP 800-53, CNSSI, continuous monitoring, vulnerability management, POA&M management, and security authorization activities.


• Demonstrated ability to independently analyze technical vulnerabilities and make risk-based recommendations rather than relying solely on automated scanner severity ratings.


• Experience with UIPath or similar automation tools and automation solution development.


• Strong understanding of Windows and Linux operating systems, enterprise networking, security architecture, authentication, virtualization, and common enterprise security technologies.


• Ability to communicate complex technical cybersecurity issues and risk determinations effectively to engineers, system owners, cybersecurity leadership, and senior decision-makers.


• Support RMF, Assessment and Authorization (A&A), continuous monitoring, POA&M management, security assessments, and risk-acceptance activities for National Security Systems (NSS) and other sensitive/classified environments.


• Apply NIST SP 800-53, CNSSI 1253, ICD 503, DISA STIGs/SRGs, and other applicable federal and Intelligence Community cybersecurity requirements.


• Integrate vulnerability information with other enterprise security capabilities, including SIEM, logging, endpoint security, and threat intelligence platforms, to improve risk analysis and situational awareness.


• Develop vulnerability metrics, trend analyses, technical assessments, and executive-level reporting and provide defensible recommendations to technical and senior leadership.


• Serve as a trusted technical advisor and provide guidance and mentorship to cybersecurity analysts, engineers, and system administrators.

Preferred Qualifications

Master's degree in Cybersecurity, Information Assurance, Computer Science, Information Systems, Engineering, or related discipline.

CISSP, CISM, or comparable advanced cybersecurity certification; multiple advanced cybersecurity certifications are highly desired.

Current DHS Entry on Duty (EOD) suitability/clearance.

• Experience supporting multiple National Security Systems (NSS) and complex accreditation environments.


• Extensive experience with NIST SP 800-53, CNSSI 1253, ICD 503, DISA STIGs/SRGs, and federal or Intelligence Community cybersecurity requirements.


• Experience administering or integrating enterprise cybersecurity technologies such as Tenable Security Center/Tenable.sc, Nessus, Splunk, SIEM, endpoint security, or related platforms.


• Experience as an ISSE, ISSM, or senior ISSO.


• Experience with cross-domain solutions and security architectures spanning multiple security boundaries.


• Experience leading or providing technical oversight of enterprise cybersecurity operations.


• Knowledge of MITRE ATT&CK and adversary tactics, techniques, and procedures.


• Experience with incident response, threat hunting, cyber operations, or adversary emulation.


• Experience with Windows Server, Linux, Active Directory, network infrastructure, virtualization, and enterprise security technologies.


• Experience developing and presenting technical risk recommendations to senior government and program leadership.


• Strong critical-thinking, problem-solving, technical research, and written communication skills.

If you're looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo - because the mission demands it. We're not hiring followers. We're recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We're already at step 30 - and moving faster than anyone else dares.

Original Posting

September 17, 2026

For U.S. Positions: While subject to change based on business needs, Leidos reasonably anticipates that this job requisition will remain open for at least 3 days with an anticipated close date of no earlier than 3 days after the original posting date as listed above.

Pay Range $131,300.00 - $237,350.00

The Leidos pay range for this job level is a general guideline onlyand not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.

About Leidos

Leidos is an industry and technology leader serving government and commercial customers with smarter, more efficient digital and mission innovations. Headquartered in Reston, Virginia, with 47,000 global employees, Leidos reported annual revenues of approximately $16.7 billion for the fiscal year ended January 3, 2025. For more information, visit www.Leidos.com.

Pay and Benefits

Pay and benefits are fundamental to any career decision. That's why we craft compensation packages that reflect the importance of the work we do for our customers.

• Employment benefits include competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement.

More details are available at www.leidos.com/careers/pay-benefits.

Commitment to Non-Discrimination

All qualified applicants will receive consideration for employment without regard to sex, race, ethnicity, age, national origin, citizenship, religion, physical or mental disability, medical condition, genetic information, pregnancy, family structure, marital status, ancestry, domestic partner status, sexual orientation, gender identity or expression, veteran or military status, or any other basis prohibited by law. Leidos will also consider for employment qualified applicants with criminal histories consistent with relevant laws.