Senior Security Architect

Leidos•Bethesda, MD

About The Position

Leidos is hiring a Senior Security Architect to support accreditation and security engineering for the DOMEX Technology Platform (DTP), which helps centralize and standardize the collection, processing, exploitation, and dissemination of Open Source Intelligence across the Defense and Intelligence Community. The platform uses cloud computing, artificial intelligence, machine learning, and cross-domain transfer systems to support data exploitation, enrichment, triage, and analytics. The role provides technical expertise in securing, hardening, and maintaining compliance for cloud-based software platforms and infrastructure across multiple secure networks. The architect applies security technologies, industry practices, vulnerability management, and Risk Management Framework principles, collaborating with compliance personnel, software and systems engineers, architects, and Government counterparts to ensure regulatory compliance and a strong security posture. The position also covers multi-cloud security architecture across AWS, Azure, GCP, and OCI; integration of cloud-native security services with enterprise security platforms; Kubernetes and container security; and enterprise network security architecture. The architect assesses current capabilities, recommends technologies and designs, tunes security controls, and develops practical plans to improve security while maintaining network performance and availability.

Requirements

Active or current Top Secret/SCI clearance and the ability to obtain a polygraph.
Bachelor of Science degree from an accredited university, ideally in Computer Science, Information Assurance, Information Security System Engineering, or a related field.
At least 12 years of experience as an Information Systems Security Engineer (ISSE) or Systems Engineer on programs or contracts in the customer space.
At least one IAT certification and one IAT Level II or higher certification; examples include CCNA Security, CySA+, Security+ CE, and CISSP or CISSP Associate.
Ability to obtain Privileged User Account (PUA)/elevated access in accordance with DoD policy.
Solid understanding of security practices and policies, with hands-on vulnerability testing experience using customer tools.
Experience applying the Risk Management Framework.
Demonstrated knowledge of and experience with common security tools, such as ACAS, Prisma Cloud, and Splunk or Elastic.
Experience with SCAP or STIG-based tools and specifications.
Extensive experience designing enterprise security solutions and translating security requirements into implementable technical architectures.
Knowledge of Kubernetes and container security, including image security, admission controls, secrets, identity, network policies, software supply chain security, scanning, and runtime protection.
Experience designing solutions involving SIEM, vulnerability management, identity security, network security, secrets management, container scanning, and data protection technologies.
Experience with data modeling and mapping system data flows for cybersecurity analysis.
Understanding of microservices architecture and service mesh.

Nice To Haves

Active TS/SCI clearance with polygraph.
Experience with Commercial Cloud Services (C2S) and cloud-based enterprise services, preferably AWS.
Five years of experience with Defense in Depth principles and technologies—including access control, authorization, identification and authentication, public key infrastructure, and network and enterprise security architecture—and applying risk assessment methodology to system development.
DoD 8570 compliance with IASAE Level 2 or 3.
Experience installing, configuring, testing, deploying, operating, and maintaining enterprise network scanning and reporting tools such as Trellix/ESS, ACAS, Evaluate STIG, SteelCloud ConfigOS, Prisma Cloud, and STIG Manager.
Extensive experience hardening Oracle Linux, RHEL, and Microsoft Windows environments using Security Technical Implementation Guides (STIGs).
Information Systems Security Engineering Professional (ISSEP) certification.
Computer Information Systems Security Professional (CISSP) certification.
Experience designing, implementing, and maintaining Splunk environments, including forwarders, indexers, search heads, and deployment servers.
Hands-on experience with two or more of Palo Alto Prisma Cloud, Splunk, Elastic, or Evaluate STIG.

Responsibilities

Validate and verify system security requirements and establish security designs for large-scale systems, major system elements, and interfacing systems in complex, geographically distributed network environments.
Recommend and develop technical solutions, products, and standards based on current and desired system security architecture.
Collaborate with internal technical experts and communicate with Program Managers and customer organization points of contact about significant security issues.
Participate in Program Increment Planning and related agile team activities.
Work with System Engineering, Test Engineering, and Integration teams to ensure hardware and software architecture and implementation meet security requirements.
Evaluate how new development affects the system’s operational security posture.
Serve as a security architecture subject matter expert and advise Program Managers, customer technical experts, and internal program teams.
Improve engineering processes, documentation standards, implementation playbooks, migration runbooks, technical standards, and execution models.
Design security architectures and solutions across AWS, Azure, GCP, and OCI, accounting for shared patterns and cloud-provider-specific capabilities and limitations.
Architect integrations between native security services and enterprise platforms, including vulnerability management, STIG evaluation, and SIEM tools.
Design and implement enterprise network security architecture, including firewalls, intrusion detection and prevention, web and TLS proxies, VPN and encryption services, network access control, DNS security, and east-west controls.
Assess network security architecture, identify gaps and opportunities, estimate effort and implementation risk, and develop engineering plans.
Specify network security architecture, evaluate emerging technologies, and conduct needs assessments to inform design and investment decisions.
Tune security controls to reduce false positives, close coverage gaps, and improve detection and enforcement without harming network performance or availability.
Monitor system security status, identify risks and vulnerabilities, and coordinate remediation with system owners, engineers, and other stakeholders.
Design, implement, and maintain Splunk environments, including forwarders, indexers, search heads, and deployment servers, if bringing the preferred experience.