Security Information & Event Management, SME

Leidos

. Maintain and support active and upcoming SIEM platforms .

Posted 10/15/2026full-timeColumbus • Ohio • United StatesSeniorLead💰 $107,900 - $195,050 per yearWebsite

Tech Stack

Tools & technologies

CloudCyber SecurityLinuxTCP/IPTypeScriptUnix

About the role

Key responsibilities & impact

Maintain and support active and upcoming SIEM platforms
Administer and sustain enterprise SIEM platforms and analytics across their lifecycle
Research advanced analytics, visualizations, exploits, and associated detections to develop actionable defensive solutions
Train cybersecurity analysts on SIEM tool operation and usage
Identify, report, and track SIEM outages and complex issues that cannot be resolved locally
Coordinate and collaborate directly with government stakeholders to integrate emerging capabilities
Deliver complex technical reports
Engage with customers and mission partners
Ensure critical data feeds and operational readiness
Empower cybersecurity analysts through analytics, visualizations, and operational workflows
Provide network operations and cyber defense support to DISA, the DoD, and Combatant Commands

Requirements

What you’ll need

Active DoD Top Secret (TS) clearance, with the ability to obtain and maintain a TS/SCI
Must currently reside within a 2-hour commute of Columbus, OH or be willing to relocate
Current DoD 8570 IAT Level II or higher certification (e.g., Security+ CE, SSCP, GSEC, or 8140 equivalent)
Ability to obtain a DoD 8570 CSSP-Analyst certification (e.g., CEH, CySA+, GCIA) within 180 days of hire
Bachelor's degree in a related discipline with 8+ years of applicable experience; additional related experience accepted in lieu of degree
Deep architectural, engineering, and operational expertise with enterprise SIEM platforms, such as Elastic/Kibana, MDE/Sentinel, Tines, and Darktrace
Hands-on CND (Protect, Detect, Respond, Sustain) experience in a computer incident response environment
Strong grasp of threat lifecycles, attack vectors, and adversary TTPs
Advanced networking knowledge, including TCP/IP, ports/protocols, traffic flow, OSI model, and defense-in-depth
Experience analyzing high-volume logs, Netflow, Full Packet Capture, and attack artifacts
Ability to work independently, engage in technical self-study, collaborate across cross-functional teams, and adjust work hours/schedules as mission needs dictate
Preferred: current DoD 8570 CSSP-Analyst certifications and/or advanced vendor certifications in enterprise SIEM platforms
Preferred: prior DISA and DoD network support experience, including identifying and countering APTs and emergent cyber threats
Preferred: SIEM engineering, production-grade SIEM sustainment, extended cyber analytics, and Detection-as-Code experience
Preferred: Linux and Windows systems administration, virtualized or cloud environments, Unix/Linux CLI navigation, scripting/programming, and API development/integration
Preferred: Intelligence-Driven Defense, Cyber Kill Chain, malware analysis, and complex technical report authoring