{"id":144928,"url":"https://alion.io/job/leidos-endpoint-security-analyst-elastic-defend","title":"Endpoint Security Analyst – Elastic Defend","company":{"id":7791,"name":"Leidos","domain":"leidos.com","url":"https://alion.io/company/leidos","size_band":"5000+","is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":78,"open_postings":275,"ghost_share":0.004,"stale_share":0.865,"repost_share":0.011,"time_to_fill_p50_days":28,"computed_at":"2026-10-30T05:48:23Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Adelphi, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":107900,"max":195050,"currency":"USD","period":"year","gross":null,"usd_annual":195050},"salary_estimate":null,"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"GCP","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Crowdstrike","optional":true},{"name":"Tanium","optional":true}],"status":"live","first_seen_at":"2026-08-25T00:00:00Z","employer_posted_date":"2026-08-25","last_verified_at":"2026-10-30T19:33:54Z","board_verified":true,"closed_at":null,"days_open":66,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":66},"description":"The C5ISR Center Cyber Security Service Provider (CSSP) is a premier defensive cyber operations organization supporting the Department of War (DoW). Operating 24x7x365, the CSSP provides continuous monitoring, threat detection, incident response, and vulnerability management across cloud and on-premises environments, including AWS, Azure, GCP, Oracle Cloud, and SaaS platforms.\nEvery day, our team protects the networks, systems, and data that enable critical DoW missions.\nLeidos has an immediate opportunity for an experiencedEndpoint Security Analyst to support a highly visible, strategic Cybersecurity Task Order. In this role, you will provide specialized expertise supporting Elastic Agent and Elastic Defend, helping deploy, configure, optimize, and sustain endpoint protection, telemetry collection, threat detection, and automated response capabilities across the enterprise.\nYou will work closely with threat, engineering, and cybersecurity operations teams to strengthen endpoint defenses, improve visibility, and rapidly identify and respond to emerging cyber threats.\nLocation: Hybrid - 3 days on site at Adelphi, MD\nClearance: U.S. Citizenship with an active TS/SCI with SAP Eligibility\nPrimary Responsibilities:\nDeploy, configure, operate, tune, upgrade, and troubleshoot Elastic Agent, Elastic Defend, and other enterprise endpoint security technologies.\n\nOptimize endpoint protection and telemetry collection to maximize security visibility and detection effectiveness while minimizing operational and system performance impacts.\n\nPartner with Threat and Detection teams to customize detection rules, develop threat signatures, and align endpoint defenses with emerging threat intelligence and MITRE ATT&CK techniques.\n\nConduct host-based defensive cyber operations to identify, investigate, contain, mitigate, and remediate vulnerabilities and intrusions.\n\nSupport cyber investigations using advanced endpoint queries, forensic data collection, and rapid containment and response capabilities.\n\nBuild and maintain queries, dashboards, and reports that provide enterprise security visibility and leadership awareness.\n\nCoordinate with engineering teams on endpoint security deployments, patches, hot fixes, upgrades, and other critical security updates.\n\nTroubleshoot endpoint security tool issues, performance concerns, and outages.\n\nDevelop and maintain endpoint security policies, configurations, and Standard Operating Procedures (SOPs).\n\nEvaluate emerging endpoint security tools, techniques, and technologies and recommend improvements aligned with enterprise cybersecurity strategy.\n\nBasic Qualifications:\nBachelor's degree in Science, Technology, Engineering, Mathematics (STEM), cybersecurity, or a related field and 4+ years of relevant cybersecurity experience.\n\nHands-on experience deploying, configuring, operating, or supporting enterprise endpoint security or EDR solutions.\n\nStrong understanding of endpoint protection, security telemetry, threat detection, incident investigation, and response.\n\nExperience investigating and responding to endpoint security alerts and potential compromises.\n\nKnowledge of current cyber threats, attacker techniques, and defensive strategies, including familiarity with the MITRE ATT&CK framework.\n\nStrong analytical, troubleshooting, and problem-solving skills.\n\nAbility to work effectively across cybersecurity, threat, and engineering teams.\n\nStrong written and verbal communication skills.\n\nU.S. citizenship and an active TS/SCI with SAP eligibility.\n\nAt least one of the following certifications:\nGIAC/SANS: GCIA, GCIH, GCFA, GCFE, GREM, GISF, GXPN, GWEB, GNFA, or GMON\n\nOffensive Security: OSCP, OSCE, OSWP, or OSEE\n\nISC2: CCFP or CISSP\n\nEC-Council: CEH, CHFI, LPT, ECSA, or ECI\n\nPreferred Qualifications:\nHands-on experience with Elastic Agent and Elastic Defend, including deployment, configuration, policy management, tuning, and troubleshooting.\n\nExperience optimizing endpoint telemetry and security controls in large-scale enterprise environments.\n\nExperience developing or tuning endpoint detection rules, threat signatures, IOCs, and behavioral detections.\n\nExperience using Elastic capabilities for endpoint investigation, advanced querying, forensic data collection, and response actions.\n\nExperience with CrowdStrike Falcon, McAfee/Trellix ePO, Tanium, or similar enterprise endpoint security platforms.\n\nExperience deploying and configuring CrowdStrike Falcon sensors and creating custom Indicators of Compromise (IOCs) and Indicators of Attack (IOAs).\n\nExperience supporting endpoint security operations within large, complex, or mission-critical environments.\n\nRelevant endpoint security certifications, such as Elastic, CrowdStrike, or Tanium certifications.\n\nIf you're looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo - because the mission demands it. We're not hiring followers. We're recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We're already at step 30 - and moving faster than anyone else dares.\nOriginal Posting:\nAugust 25, 2026For U.S. Positions: While subject to change based on business needs, Leidos reasonably anticipates that this job requisition will remain open for at least 3 days with an anticipated close date of no earlier than 3 days after the original posting date as listed above.\n Pay Range:\nPay Range $107,900.00 - $195,050.00The Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.","description_format":"text","description_chars":5830,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[]},"benefits":["Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Endpoint Security","Vulnerability Management","National Security","C4ISR"],"lifecycle":[{"event":"open","at":"2026-08-25T00:00:00Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 50 · green card filings: 24","filings_12m":50,"filings_prev_12m":58,"green_card_filings_12m":24,"median_offered_wage_usd":124257,"route":null,"cap_exempt":false,"checked_at":"2026-10-29T16:27:21+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":4}],"liveness":{"score":11,"band":"cold","label":"Long shot","p_open":1,"p_active":0.387,"p_room":0.28,"age_days":66,"expected_fill_days":28,"reasons":["conf:1","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-30T05:48:23Z"},"pay":{"stated_usd_annual":195050,"is_top_pay":true},"html_url":"https://alion.io/job/leidos-endpoint-security-analyst-elastic-defend","json_url":"https://alion.io/job/leidos-endpoint-security-analyst-elastic-defend.json","meta":{"generated_at":"2026-10-30T20:22:33Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":10284,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-31T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":7791},"rest":"https://alion.io/mcp/rest/get_company?id=7791"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fleidos-endpoint-security-analyst-elastic-defend"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fleidos-endpoint-security-analyst-elastic-defend"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fleidos-endpoint-security-analyst-elastic-defend"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/leidos-endpoint-security-analyst-elastic-defend\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fleidos-endpoint-security-analyst-elastic-defend"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":144928}},{"tool":"search_jobs","arguments":{"company":"leidos.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":144928},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}