Senior Security Architect

Leidos•Bethesda, MD

11d•$131,300 - $237,350

About The Position

Leidos is hiring a Senior Security Architect for the DOMEX Technology Platform (DTP), supporting the mission to centralize and standardize Tasking, Collection, Processing, Exploitation and Dissemination of Open Source Intelligence across Defense and Intelligence Community enterprises. The platform uses cloud computing, artificial intelligence, machine learning, and cross-domain transfer systems to deliver data exploitation, enrichment, triage, and analytics capabilities. The position provides technical security expertise to secure, harden, and maintain compliance of cloud-based software platforms and infrastructure across multiple secure networks. The architect applies security technologies, industry best practices, vulnerability management, and Risk Management Framework (RMF) methods while working with compliance personnel, software and system engineers, system architects, and Government counterparts. The role encompasses security architecture across AWS, Azure, GCP, and OCI; integration of cloud-native security services with enterprise security platforms; Kubernetes and container security; and enterprise network security. The architect evaluates security posture and emerging technologies, develops implementation plans and specifications, and improves engineering processes and documentation to support delivery and sustainment.

Requirements

Active or current Top Secret/SCI clearance and ability to obtain a polygraph.
Bachelor of Science degree from an accredited university, ideally in Computer Science, Information Assurance, Information Security System Engineering, or a related field, and at least 12 years of experience as an Information Systems Security Engineer or System Engineer on programs or contracts in the customer space.
At least one IAT certification and one IAT Level II or higher certification, such as CCNA Security, CySA+, Security+ CE, or CISSP (or Associate).
Ability to obtain Privileged User Account (PUA) or elevated access in accordance with DoD policy.
Solid understanding of security practices and policies, and hands-on vulnerability testing experience using customer tools.
Experience applying the Risk Management Framework.
Demonstrated knowledge of and experience with common security tools such as ACAS, Prisma Cloud, and Splunk or Elastic.
Experience with SCAP or STIG-based tools and specifications.
Extensive experience designing enterprise security solutions and translating security requirements into implementable technical architectures.
Knowledge of Kubernetes and container security architectures, including image security, admission controls, secrets, identity, network policies, software supply chain security, and runtime protection.
Experience designing solutions involving SIEM, vulnerability management, identity security, network security, secrets management, container scanning, and data protection technologies.
Experience with data modeling and mapping system data flows for cybersecurity analysis.
Understanding of microservices architecture and service mesh.

Nice To Haves

Active TS/SCI clearance with polygraph.
Experience with Commercial Cloud Services (C2S) and cloud-based enterprise services, preferably AWS.
Five years of experience with Defense in Depth principles and technology, including access control, authorization, identification and authentication, public key infrastructure, network and enterprise security architecture, and applying risk assessment methodology to system development.
DoD 8570 compliance with IASAE Level 2 or 3.
Experience installing, configuring, testing, deploying, operating, and maintaining enterprise network-based scanning and reporting tools such as Trellix/ESS, ACAS, Evaluate STIG, SteelCloud ConfigOS, Prisma Cloud, and STIG Manager.
Extensive experience hardening Oracle Linux, RHEL, and Microsoft Windows environments using Security Technical Implementation Guides (STIGs).
Information Systems Security Engineering Professional (ISSEP) certification.
Computer Information Systems Security Professional (CISSP) certification.
Experience designing, implementing, and maintaining Splunk environments, including forwarders, indexers, search heads, and deployment servers.
Hands-on experience with two or more of Palo Alto Prisma Cloud, Splunk, Elastic, or Evaluate STIG.

Responsibilities

Validate and verify system security requirements and establish security designs for large-scale systems, major system elements, and interfacing systems in geographically distributed network environments.
Recommend and develop technical solutions, products, and standards based on current and desired system security architecture.
Collaborate with internal technical experts and communicate significant security issues to Program Managers and customer organization points of contact when necessary.
Participate in Program Increment Planning and related agile team activities.
Work with System Engineering, Test Engineering, and Integration teams to ensure hardware and software architecture and implementation meet security requirements.
Evaluate the effect of new development on the system's operational security posture.
Serve as a security architecture subject matter expert and advise Program Managers, customer technical experts, and internal program teams.
Improve engineering processes, documentation standards, implementation playbooks, migration runbooks, technical standards, and execution models to accelerate delivery, reduce rework, improve operational handoff, and reduce sustainment burden.
Design security architectures and solutions spanning AWS, Azure, GCP, and OCI, accounting for common architectural patterns and provider-specific capabilities and limitations.
Architect integrations between native security services and enterprise platforms, including vulnerability management products, STIG evaluation, and SIEM.
Design and implement container and Kubernetes security architectures, including image security, admission controls, secrets, identity, network policies, software supply chain security, scanning, and runtime protection.
Design, engineer, and implement enterprise network security architecture spanning next-generation firewalls, intrusion detection and prevention, web and TLS proxies, VPN and encryption services, network access control, DNS security, and east-west security controls.
Evaluate existing network security architecture, identify gaps and improvement opportunities, estimate effort, assess implementation risk, and develop practical engineering plans.
Specify network security architecture, evaluate and recommend emerging technologies, and conduct needs assessments to inform design and investment decisions.
Tune and optimize security controls to reduce false positives, close coverage gaps, and improve detection and enforcement without degrading network performance or availability.
Monitor system security status, identify risks and vulnerabilities, and coordinate remediation with system owners, engineers, and other stakeholders.
Design, implement, and maintain Splunk environments, including forwarders, indexers, search heads, and deployment servers (preferred qualification).