Description

Reporting to the Leidos NSOC Lead, the Top Secret cleared NSOC Tool Specialist manages and modifies the configuration of network and system management and security tools in support of the network and security operators.

The position may require infrequent short-term travel to CONUS and OCONUS sites. This position may require an infrequent shift in workday schedule to support exercises occurring over weekends.

Primary Responsibilities

• Responsible for configuration, standardization, reliable performance, and patching of tools used by the NSOC, including Splunk Enterprise Security, Splunk SOAR, ServiceNow IT Operations Management, SolarWinds, Security Onion, and ACAS (Tenable.sc or Tenable Nessus).
• Develops artifacts supporting Information Assurance and Risk Management Framework (RMF) processes.

• Bachelor's degree with 15 - 20 years of related experience. Additional years of relevant experience may be considered in lieu of degree.
• Top Secret clearance with ability to obtain and maintain TS/SCI clearance.
• At least 2 years of experience with two or more of the following: Splunk, ServiceNow, SolarWinds, Elasticsearch/Logstash/Kibana, and ACAS (Tenable.sc or Nessus).
• Experience configuring and deploying a variety of operating systems and networking platforms.
• Experience with configuration and administration of Splunk ingestion and forwarding for new and existing applications and data.
• Experience creating dashboards and analytics within SIEM tools.
• Experience working with monitoring systems supporting auditing, incident response, and system health.
• The ability to troubleshoot issues with log feeds, search time, and field extractions.
• At least one current DoD 8140 certification

• Active Splunk Enterprise Certified Administrator certification or higher.
• Experience in design, implementation, and support of Splunk core components, including indexers, forwarders, search heads, and cluster managers.
• Experience with troubleshooting Splunk dataflow issues between the various Splunk core components.
• Experience creating workflows for Incident Response within Splunk.
• Experience with virtualized environments (VMware vSphere, ESXi). Experience working with cloud computing and infrastructure security (AWS, Azure, etc.) to IL6.
• Experience as a member of agile programs.
• Network Security Operations Center (NSOC), Network Operations Center (NOC), or Security Operations Center (SOC) experience.
• Experience and skill in data visualization.