Principal Cybersecurity Engineer

Leidos•McLean, VA

About The Position

Leidos is hiring a Principal Cybersecurity Engineer in its Intel Sector’s Analysis Solutions Business Area. The role protects customer information systems, networks, and infrastructure from cyber threats and vulnerabilities. It supports the design, implementation, and maintenance of security controls for mission systems and compliance with applicable cybersecurity policies, standards, and regulatory frameworks. The engineer works with Information Systems Security Engineers (ISSEs), Information Systems Security Managers (ISSMs), software developers, systems engineers, and government stakeholders throughout the DevSecOps lifecycle. The position encompasses cybersecurity engineering activities including implementing security technologies, supporting incident response, and ensuring systems meet security and compliance requirements. The role requires a BS degree and 12 or more years of relevant experience, or an MS degree and 10 or more years of relevant experience; additional experience may substitute for a degree. An active TS/SCI with Polygraph is required. Professional cybersecurity certifications such as Security+, CISSP, CySA+, CEH, or GCIH are also listed as a basic qualification. The stated pay range is $131,300 to $237,350.

Requirements

BS degree and 12 or more years of prior relevant experience, or MS degree and 10 or more years of prior relevant experience; additional years of experience may substitute for a degree.
Active TS/SCI with a Polygraph.
Experience implementing and managing SIEM tools such as Splunk or similar platforms.
Experience with endpoint and network security technologies, including IDS/IPS, HBSS/Trellix, Carbon Black EDR, and related defensive security tools.
Experience reviewing and analyzing cybersecurity event logs to identify indicators of compromise or suspicious activity.
Experience supporting incident response plans, vulnerability management programs, risk management plans, and POA&Ms.
Experience conducting or supporting technical cybersecurity assessments and security audits.
Experience identifying system vulnerabilities and non-compliance with cybersecurity standards and regulatory requirements.
Experience collaborating with DevSecOps teams to review vulnerability scan results and support remediation.
Experience supporting RMF authorization by reviewing security documentation and providing risk-based recommendations as part of ATO activities.
Experience managing and tracking POA&Ms for customer-sponsored systems and coordinating with relevant security stakeholders.
Experience applying system security engineering principles, including system security design, lifecycle engineering, authentication and authorization, cryptography, intrusion detection, contingency planning, incident handling, auditing, configuration management, and change control.
Professional cybersecurity certification such as Security+, CISSP, CySA+, CEH, or GCIH.

Nice To Haves

Experience with Rapid7, Tenable/Nessus, SonarQube, Fortify, Chainguard, EDR platforms, STIG viewers, or compliance tools for assessing systems against security configuration baselines.
Experience implementing and managing network and application firewalls, incident detection platforms, and digital forensic tools.
Experience with automation tools such as Ansible or CloudFormation for infrastructure and security automation.
Experience in Agile software development environments and with scripting or programming languages such as Python or PowerShell.
Familiarity with cloud environments including AWS, Oracle Cloud, or Google Cloud Platform.
Experience with system monitoring and health tools such as SolarWinds.
Experience with DevSecOps pipelines and CI/CD security tools.
Experience administering or securing Linux systems, including Red Hat.

Responsibilities

Plan, implement, manage, monitor, and upgrade security controls and tools protecting enterprise systems and networks, and identify opportunities to automate repeatable operations tasks.
Design, configure, implement, troubleshoot, and maintain security technologies, including firewalls or security groups, endpoint protection tools, and SIEM platforms.
Monitor system and network security using SIEM tools such as Splunk Enterprise Security to detect, analyze, and respond to potential threats or anomalous activity.
Support investigation and remediation of cybersecurity incidents, including system or network breaches and malware infections.
Participate in change management to help ensure system changes maintain security compliance and do not introduce vulnerabilities.
Audit systems and configurations for compliance with cybersecurity policies, standards, and secure configuration baselines.
Collaborate with engineering, development, and operations teams to integrate security controls into DevSecOps pipelines and system architectures.
Monitor security advisories, bulletins, and threat intelligence for current vulnerabilities, threats, and trends.
Assist with implementation and enforcement of secure system configurations and cybersecurity compliance requirements.
Review vulnerability scan results, assess risk, and coordinate remediation with system owners and technical teams.
Support incident response plans, vulnerability management programs, risk management plans, and Plans of Action and Milestones (POA&Ms).
Support technical cybersecurity assessments and security audits; identify vulnerabilities and non-compliance with cybersecurity requirements.
Support the Risk Management Framework authorization process by reviewing security documentation and providing risk-based recommendations for Authority to Operate activities.
Manage and track POA&Ms for customer-sponsored systems, coordinating with ISSOs, ISSEs, ISSMs, and Security Control Assessors.
Apply system security engineering principles in areas including security design, lifecycle engineering, authentication and authorization, cryptography, intrusion detection, contingency planning, incident handling, auditing, configuration management, and change control.