AI & Security Infrastructure Integration Engineer

Leidos•Alexandria, VA

3d•Hybrid

About The Position

Leidos is seeking an AI & Security Infrastructure Integration Engineer to join their team in Alexandria, VA. This is a hybrid position allowing partial telework, but the majority of the time is spent on-site and candidates must be within commutable distance. As an AI & Security Infrastructure Integration Engineer on our team, you will bridge the gap between traditional security infrastructure and modern programmatic defense. You will operate, maintain, and evolve the network security infrastructure utilized by our 24x7x365 mission-critical security operations team. Your primary focus will be transforming manual workflows into automated pipelines by leveraging Python, developing robust API integrations, and exploring AI/LLM orchestration to rapidly scale threat detection and response capabilities.

Requirements

Active DoD Secret Required with DoD TS/SCI Eligibility
Must have DoD 8570 IAT II certification OR meet DoD 8140 Intermediate Cyber Defense Infrastructure Support Specialist requirements prior to start
Must obtain DOD-8570 CSSP Infrastructure Support certification within 6 months of hire.
Bachelor's degree with 8+ years of professional experience (additional relevant military or work experience may be considered in lieu of a degree).
2+ years of hands-on experience deploying and maintaining cybersecurity tools (especially IDS/IPS, SIEM, or firewalls).
Strong, practical knowledge of network protocols, traffic analysis, and routing/switching.
Proficiency in Linux administration and shell scripting (Bash).

Nice To Haves

Strong proficiency in Python (specifically writing scripts for system automation, network interaction, and data parsing).
Demonstrated experience working with RESTful APIs, JSON/YAML data structures, and webhooks to integrate security platforms.
Exposure utilizing or fine-tuning AI/ML models, prompt engineering, or integrating AI APIs into operational workflows.
Hands-on experience with automation/orchestration frameworks (e.g., Ansible, Terraform, Puppet, or Chef).
Practical familiarity with Intelligence-Driven Defense, the Cyber Kill Chain, and mapping controls to the MITRE ATT&CK framework.
Prior experience working as or directly supporting a Security Operations Center (SOC) analyst team.

Responsibilities

Develop and maintain Python-based tools, scripts, and frameworks to automate routine security infrastructure tasks, policy deployments, and system health checks.
Design, build, and integrate custom APIs to connect disparate cybersecurity tools (SIEM, IDS/IPS, Netflow, and threat intelligence feeds) into a cohesive, orchestrated ecosystem.
Evaluate and integrate AI/ML technologies and LLM-based solutions to optimize alert triage, automate playbook generation, and accelerate incident analysis for the SOC team.
Operate, maintain, and upgrade core cybersecurity capabilities (IDS/IPS, Netflow, SIEM, Snort, Linux, and Virtualization environments).
Manage high-priority tasks, infrastructure outages, and routine patching/updates.
Maintain precise network topology and elevation diagrams for all managed security equipment.
Ensure strict adherence to government compliance standards and coordinate changes through official Change Control Boards (CCB).
Advise and strategize with program and government leadership on engineering modern, code-driven security infrastructure solutions.