> Markdown version of [/jobs/ext/4430540-security-information-and-event-management-subject-matter-expert](https://www.wearedevelopers.com/jobs/ext/4430540-security-information-and-event-management-subject-matter-expert). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Information and Event Management Subject Matter Expert

- **Company:** Leidos, Inc.
- **Location:** Columbus, OH, United States
- **Experience:** Expert
- **Salary:** $107,900.0 - $195,050.0
- **Contract:** Permanent contract
- **Skills:** Data Analysis, Cyber Security, Computer Programming, Linux, OSI Models, NetFlow, Packet Analyzer, Security Information and Event Management, TCP/IP, Scripting, Cloud Platform System, Mitre Att&ck, Malware, Cyber Threat Analysis, Cybercrime, Api Design, Kibana, Splunk, Vulnerability Analysis
- **Published:** October 16, 2026
- **Apply:** https://jobs.military.com/career/367330/security-information-event-management-siem-sme-ohio-oh-columbus

## About the Role

u2022 \nClearance & Location: Active DoD Top Secret (TS) clearance, with the ability to obtain and maintain a TS/SCI; role is 100% on-site in Columbus, OH (must currently reside within a 2-hour commute or be willing to relocate).\n
\u2022 \nRequired Certifications: Current DoD 8570 IAT Level II or higher (e.g., Security+ CE, SSCP, GSEC, or 8140 equivalent), plus the ability to obtain a DoD 8570 CSSP-Analyst certification (e.g., CEH, CySA+, GCIA) within 180 days of hire.\n
\u2022 \nEducation & Experience: Bachelor's degree in a related discipline with 8+ years of applicable experience (additional related experience accepted in lieu of degree).\n
\u2022 \nSIEM & Incident Defense: Deep architectural, engineering, and operational expertise with enterprise SIEM platforms (e.g., Elastic/Kibana, MDE/Sentinel, Tines, Darktrace), paired with hands-on CND (Protect, Detect, Respond, Sustain) experience in a computer incident response environment.\n
\u2022 \nThreat, Network & Telemetry Analysis: Strong grasp of threat lifecycles, attack vectors, and adversary TTPs, backed by advanced networking knowledge (TCP/IP, ports/protocols, traffic flow, OSI model, defense-in-depth) and demonstrated experience analyzing high-volume logs, Netflow, Full Packet Capture, and attack artifacts.\n
\u2022 \nProfessional Execution & Adaptability: Proven ability to work independently, engage in technical self-study, collaborate across cross-functional teams to solve complex problems, and adjust work hours/schedules as mission needs dictate.\n, u2022 \nDoD & Mission Experience: Prior background supporting DISA and DoD networks, with demonstrated experience identifying and countering Advanced Persistent Threats (APTs) and emergent cyber threats.\n
\u2022 \nSIEM Engineering & Analytics: Experience engineering and sustaining production-grade SIEM environments, developing extended cyber analytics, and applying Detection-as-Code principles.\n
\u2022 \nSystems Administration & Development: Linux- and Windows-based systems administration in virtualized or cloud environments, hands-on Unix/Linux CLI navigation, scripting/programming skills, and API development and integration.\n
\u2022 \nThreat Intelligence & Reporting: Strong working knowledge of Intelligence-Driven Defense, the Cyber Kill Chain methodology, malware analysis concepts/methods, and authoring complex technical reports detailing analytic findings.\n

## Description

u2022
Advanced Certifications: Current DoD 8570 CSSP-Analyst certifications (e.g., CEH, CySA+) and/or advanced vendor certifications in operating, maintaining, or administering enterprise SIEM platforms (e.g., Splunk, Elastic/Kibana, MDE/Sentinel).