Splunk Security Engineer

Are you ready to turn your skills into real-world impact?

Join Leidos as a Splunk Security Engineer in Suitland, MD and be at the forefront of mission-critical cybersecurity. From defending networks to building scalable automation, your work will shape the response and resilience of national operations.

• Develop, maintain, and execute automated SOAR playbooks that interact across systems and devices.
• Analyze log events, correlate data across multiple sources, and enhance threat detection and response workflows.
• Using SOAR connectors, design integrations between Splunk SOAR and standard DoD products such as Trellix ePO, Tanium, Cisco (Fire Power, ISE, Email Gateways, AMP, switch/routers), Palo Alto Firewalls, Microsoft Active Directory, DNS, Exchange, SharePoint, IIS, SQL, Apache, Tomcat, RSA SecurID, Tenable.
  
  SC and Nessus, VMWare vCenter/ESXi, Service Now, Azure and AWS, Net App, Windows and Linux. Connectors may use APIs, tokens, or service accounts, so understanding these options is important.
• Configure and manage Splunk Enterprise Security
  , including maintaining CIM compliance, Risk-Based Alerting (RBA), ticketing, and SIEM integrations.
• Update and configure new Enterprise Security Content Updates when released.
• Lead the full lifecycle of automation - from concept through deployment to documentation and tuning.
• Build visual dashboards, reports, and context-aware incident response tools.
• Support operational readiness, compliance, and proactive detection technologies across endpoint, cloud, network, and email infrastructures.
• Apply patches and upgrades to Splunk SOAR and connectors.
• Maintain existing/create new fleet of Development VMs (Windows, Linux) that allow you to test and demonstrate playbook functionality.
• Fully test and document playbook execution in the Development environment and be authoritative on presentation of playbook examples to new teams targeted for integration.

Required:

• Active TS/SCI clearance in DISS.
• Bachelor’s degree and 8+ years of experience or Master’s degree and 6+ years of experience. Additional experience, training, or certifications may be considered in lieu of a degree.
• Current IAT Level II certification (e.g., Security+ CE) or the ability to obtain within 30 days of Leidos start date.
• Current Splunk Certified Enterprise Security Administrator certification or the ability to obtain with 60 days of Leidos start date.
• Current Splunk SOAR Certified Automation Developer certification or the ability to obtain with 90 days of Leidos start date.
• Experience with Splunk SOAR/Phantom: playbook development, troubleshooting, and integrations.
• Deep expertise in Splunk Administration
  , security event analysis, and Python-based automation.
• Strong working knowledge of cross-platform integrations and security tool APIs.
• Experience with process improvement in fast-moving security environments.

• IAT Level III certification (e.g., CISSP).
• Proficiency in standard DoD Security and Operational products such as Active Directory, DNS, FWs (packet flows), Email, ACAS, Trellix/Tanium, Splunk, STIGs, Windows/Linux and the standard services associated with these operating systems and products.
• Technical writing skills for SOPs and integration documentation.
• Completion of Splunk SOAR training courses.
• Experience with MITRE ATT&CK integration and SOC-level triage workflows.

• Mission-Focused
  :
  Your skills will directly strengthen national security operations.
• Innovation-Driven
  :
  Get hands-on with advanced automation tools and frameworks.
• Growth-Oriented
  :
  Access certifications, trainings, and cutting-edge technical challenges.
• Team-Centric
  :
  Collaborate with passionate experts across cybersecurity, engineering, and intelligence.

Apply now and become a driving force behind modern defense operations at Leidos.

NITESONI

DABAOPP1

If you're looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo - because the mission demands it. We're not hiring followers. We're recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We're already at step 30 - and moving faster…