Vulnerability Analysis Subject Matter Expert (SME)

The Digital Sector at Leidos currently has an opening for a Vulnerability Analysis Subject Matter Expert (SME)to work in our Lorton VA office.

This is an exciting opportunity to use your experience helping the Homeland Enterprise Information Technology Secure Services & Support (HEITS) Program contracted mission.

Primary Responsibilities.

The Vulnerability Analysis Subject Matter Expert (SME) serves as a senior technical authority for vulnerability identification analysis prioritization remediation and risk assessment across sensitive and classified information systems.

The SME will evaluate vulnerabilities within the context of the operating environment and make defensible risk-based determinations based on technical severity exploitability threat intelligence system architecture existing security controls mission criticality and potential impact.

The position requires both deep technical knowledge and cybersecurity risk-management experience. The SME must be capable of translating technical vulnerability information into actionable recommendations for engineers system owners cybersecurity personnel and senior leadership.

Perform detailed analysis of vulnerabilities affecting enterprise systems applications network infrastructure operating systems virtualization platforms and security appliances.

Assess vulnerability applicability and actual organizational risk using CVSS CISA KEV EPSS vendor advisories available exploits threat intelligence system exposure architecture compensating controls and mission impact.

Research emerging and zero-day vulnerabilities and determine potential impact to organizational systems; recommend appropriate remediation mitigation monitoring or risk-acceptance actions.

Administer and maintain enterprise vulnerability assessment and management technologies including Tenable Security Center/ Nessus or comparable platforms.

Develop and manage credentialed vulnerability scanning strategies and troubleshoot scan coverage authentication connectivity and accuracy issues.

Monitor government commercial vendor and open-source cyber threat intelligence and initiate appropriate vulnerability analysis and response activities. Identify false positives non-applicable findings superseded vulnerabilities and scanner limitations requiring additional technical analysis.

Work with system administrators engineers ISSOs/ISSMs and system owners to validate findings and develop practical remediation or compensating-control strategies.

Basic Qualifications:

Bachelors degree in Cybersecurity Information Assurance Computer Science Information Systems Engineering or related discipline; or an equivalent combination of education professional training certifications and relevant experience.

Active TS/SCI security clearance is required.

Significant progressively responsible experience in IT cybersecurity information assurance security engineering vulnerability management or cyber operations.

Demonstrated experience supporting cybersecurity or risk-management activities within sensitive classified National Security System DoD Intelligence Community or comparable high-security environments.

• Demonstrated experience with enterprise vulnerability assessment and management technologies.

• Working knowledge of NIST RMF NIST SP 800-53 CNSSI continuous monitoring vulnerability management POA&M management and security authorization activities.

• Demonstrated ability to independently analyze technical vulnerabilities and make risk-based recommendations rather than relying solely on automated scanner severity ratings.

• Experience with UIPath or similar automation tools and automation solution development

• Strong understanding of Windows and Linux operating systems enterprise networking security architecture authentication virtualization and common enterprise security technologies.

• Ability to communicate complex technical cybersecurity issues and risk determinations effectively to engineers system owners cybersecurity leadership and senior decision-makers.

• Support RMF Assessment and Authorization (A&A) continuous monitoring POA&M management security assessments and risk-acceptance activities for National Security Systems (NSS) and other sensitive/classified environments.

• Apply NIST SP 800-53 CNSSI 1253 ICD 503 DISA STIGs/SRGs and other applicable federal and Intelligence Community cybersecurity requirements.

• Integrate vulnerability information with other enterprise security capabilities including SIEM logging endpoint security and threat intelligence platforms to improve risk analysis and situational awareness.

• Develop vulnerability metrics trend analyses technical assessments and executive-level reporting and provide defensible recommendations to technical and senior leadership.

• Serve as a trusted technical advisor and provide guidance and mentorship to cybersecurity analysts engineers and system administrators.

Preferred Qualifications:

Masters degree in Cybersecurity Information Assurance Computer Science Information Systems Engineering or related discipline.

CISSP CISM or comparable advanced cybersecurity certification; multiple advanced cybersecurity certifications are highly desired.

Current DHS Entry on Duty (EOD) suitability/clearance.

• Experience supporting multiple National Security Systems (NSS) and complex accreditation environments.
• Extensive experience with NIST SP 800-53 CNSSI 1253 ICD 503 DISA STIGs/SRGs and federal or Intelligence Community cybersecurity requirements.
• Experience administering or integrating enterprise cybersecurity technologies such as Tenable Security Center/ Nessus Splunk SIEM endpoint security or related platforms.
• Experience as an ISSE ISSM or senior ISSO.
• Experience with cross-domain solutions and security architectures spanning multiple security boundaries.
• Experience leading or providing technical oversight of enterprise cybersecurity operations.
• Knowledge of MITRE ATT&CK and adversary tactics techniques and procedures.
• Experience with incident response threat hunting cyber operations or adversary emulation.
• Experience with Windows Server Linux Active Directory network infrastructure virtualization and enterprise security technologies.
• Experience developing and presenting technical risk recommendations to senior government and program leadership.
• Strong critical-thinking problem-solving technical research and written communication skills.

If youre looking for comfort keep scrolling. At Leidos we outthink outbuild and outpace the status quo because the mission demands it. Were not hiring followers. Were recruiting the ones who disrupt provoke and refuse to fail. Step 10 is ancient history. Were already at step 30 and moving faster than anyone else dares.

The Leidos pay range for this job level is a general guideline onlyand not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job education experience knowledge skills and abilities as well as internal equity alignment with market data applicable bargaining agreement (if any) or other law.