Security Information and Event Management Subject Matter Expert

u2022 Advanced Certifications: Current DoD 8570 CSSP-Analyst certifications (e.g., CEH, CySA+) and/or advanced vendor certifications in operating, maintaining, or administering enterprise SIEM platforms (e.g., Splunk, Elastic/Kibana, MDE/Sentinel).

u2022 \nClearance & Location: Active DoD Top Secret (TS) clearance, with the ability to obtain and maintain a TS/SCI; role is 100% on-site in Columbus, OH (must currently reside within a 2-hour commute or be willing to relocate).\n \u2022 \nRequired Certifications: Current DoD 8570 IAT Level II or higher (e.g., Security+ CE, SSCP, GSEC, or 8140 equivalent), plus the ability to obtain a DoD 8570 CSSP-Analyst certification (e.g., CEH, CySA+, GCIA) within 180 days of hire.\n \u2022 \nEducation & Experience: Bachelor’s degree in a related discipline with 8+ years of applicable experience (additional related experience accepted in lieu of degree).\n \u2022 \nSIEM & Incident Defense: Deep architectural, engineering, and operational expertise with enterprise SIEM platforms (e.g., Elastic/Kibana, MDE/Sentinel, Tines, Darktrace), paired with hands-on CND (Protect, Detect, Respond, Sustain) experience in a computer incident response environment.\n \u2022 \nThreat, Network & Telemetry Analysis: Strong grasp of threat lifecycles, attack vectors, and adversary TTPs, backed by advanced networking knowledge (TCP/IP, ports/protocols, traffic flow, OSI model, defense-in-depth) and demonstrated experience analyzing high-volume logs, Netflow, Full Packet Capture, and attack artifacts.\n \u2022 \nProfessional Execution & Adaptability: Proven ability to work independently, engage in technical self-study, collaborate across cross-functional teams to solve complex problems, and adjust work hours/schedules as mission needs dictate.\n, u2022 \nDoD & Mission Experience: Prior background supporting DISA and DoD networks, with demonstrated experience identifying and countering Advanced Persistent Threats (APTs) and emergent cyber threats.\n \u2022 \nSIEM Engineering & Analytics: Experience engineering and sustaining production-grade SIEM environments, developing extended cyber analytics, and applying Detection-as-Code principles.\n \u2022 \nSystems Administration & Development: Linux- and Windows-based systems administration in virtualized or cloud environments, hands-on Unix/Linux CLI navigation, scripting/programming skills, and API development and integration.\n \u2022 \nThreat Intelligence & Reporting: Strong working knowledge of Intelligence-Driven Defense, the Cyber Kill Chain methodology, malware analysis concepts/methods, and authoring complex technical reports detailing analytic findings.\n

n This role is located in Columbus, OH and has a 100% on site requirement. As the SIEM SME, you will actively engage with customers and mission partners, maintain and support current and future SIEM platforms, ensure critical data feeds and operational readiness, and empower cyber security analysts through the creation of analytics, visualizations, and operational workflows.\n \n \nWhat You Will Do (Primary Responsibilities)\n \u2022 Maintain and support active and upcoming SIEM platforms.\n \u2022 Administer and sustain enterprise SIEM platforms and analytics across their lifecycle.\n \u2022 Research advanced analytics, visualizations, exploits, and associated detections to develop actionable defensive solutions.\n \u2022 Train cyber security analysts on the operation and usage of SIEM tools.\n \u2022 Identify, report, and track SIEM outages and complex issues that cannot be resolved locally.\n \u2022 Coordinate and collaborate directly with government stakeholders to integrate emerging capabilities.\n \u2022 Deliver complex technical reports while demonstrating self-motivation and strong written and verbal communication.\n \n

If you’re looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo - because the mission demands it. We’re not hiring followers. We’re recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We’re already at step 30 - and moving faster than anyone else dares.