Splunk Security Engineer

Leidos•Suitland, MD

1d•$107,900 - $195,050•Onsite

About The Position

Join Leidos as a Splunk Security Engineer in Suitland, MD and be at the forefront of mission-critical cybersecurity. From defending networks to building scalable automation, your work will shape the response and resilience of national operations. As a core member of our security engineering team, you will develop, maintain, and execute automated SOAR playbooks that interact across systems and devices. You will analyze log events, correlate data across multiple sources, and enhance threat detection and response workflows. Using SOAR connectors, design integrations between Splunk SOAR and standard DoD products such as Trellix ePO, Tanium, Cisco (FirePower, ISE, Email Gateways, AMP, switch/routers), Palo Alto Firewalls, Microsoft Active Directory, DNS, Exchange, SharePoint, IIS, SQL, Apache, Tomcat, RSA SecurID, Tenable.SC and Nessus, VMWare vCenter/ESXi, ServiceNow, Azure and AWS, NetApp, Windows and Linux. Connectors may use APIs, tokens, or service accounts, so understanding these options is important. You will configure and manage Splunk Enterprise Security, including maintaining CIM compliance, Risk-Based Alerting (RBA), ticketing, and SIEM integrations. Update and configure new Enterprise Security Content Updates when released. Lead the full lifecycle of automation - from concept through deployment to documentation and tuning. Build visual dashboards, reports, and context-aware incident response tools. Support operational readiness, compliance, and proactive detection technologies across endpoint, cloud, network, and email infrastructures. Apply patches and upgrades to Splunk SOAR and connectors. Maintain existing/create new fleet of Development VMs (Windows, Linux) that allow you to test and demonstrate playbook functionality. Fully test and document playbook execution in the Development environment and be authoritative on presentation of playbook examples to new teams targeted for integration.

Requirements

Active TS/SCI clearance in DISS.
Bachelor’s degree and 8+ years of experience or Master’s degree and 6+ years of experience. Additional experience, training, or certifications may be considered in lieu of a degree.
Current IAT Level II certification (e.g., Security+ CE) or the ability to obtain within 30 days of Leidos start date.
Current Splunk Certified Enterprise Security Administrator certification or the ability to obtain with 60 days of Leidos start date.
Current Splunk SOAR Certified Automation Developer certification or the ability to obtain with 90 days of Leidos start date.
Experience with Splunk SOAR/Phantom: playbook development, troubleshooting, and integrations.
Deep expertise in Splunk Administration, security event analysis, and Python-based automation.
Strong working knowledge of cross-platform integrations and security tool APIs.
Experience with process improvement in fast-moving security environments.

Nice To Haves

IAT Level III certification (e.g., CISSP).
Proficiency in standard DoD Security and Operational products such as Active Directory, DNS, FWs (packet flows), Email, ACAS, Trellix/Tanium, Splunk, STIGs, Windows/Linux and the standard services associated with these operating systems and products.
Technical writing skills for SOPs and integration documentation.
Completion of Splunk SOAR training courses.
Experience with MITRE ATT&CK integration and SOC-level triage workflows.

Responsibilities

Develop, maintain, and execute automated SOAR playbooks that interact across systems and devices.
Analyze log events, correlate data across multiple sources, and enhance threat detection and response workflows.
Using SOAR connectors, design integrations between Splunk SOAR and standard DoD products such as Trellix ePO, Tanium, Cisco (FirePower, ISE, Email Gateways, AMP, switch/routers), Palo Alto Firewalls, Microsoft Active Directory, DNS, Exchange, SharePoint, IIS, SQL, Apache, Tomcat, RSA SecurID, Tenable.SC and Nessus, VMWare vCenter/ESXi, ServiceNow, Azure and AWS, NetApp, Windows and Linux. Connectors may use APIs, tokens, or service accounts, so understanding these options is important.
Configure and manage Splunk Enterprise Security, including maintaining CIM compliance, Risk-Based Alerting (RBA), ticketing, and SIEM integrations.
Update and configure new Enterprise Security Content Updates when released.
Lead the full lifecycle of automation - from concept through deployment to documentation and tuning.
Build visual dashboards, reports, and context-aware incident response tools.
Support operational readiness, compliance, and proactive detection technologies across endpoint, cloud, network, and email infrastructures.
Apply patches and upgrades to Splunk SOAR and connectors.
Maintain existing/create new fleet of Development VMs (Windows, Linux) that allow you to test and demonstrate playbook functionality.
Fully test and document playbook execution in the Development environment and be authoritative on presentation of playbook examples to new teams targeted for integration.