below marketmost similar roles pay hereabove market
This role pays more than
60%
of similar roles. Most pay
$157,937–$211,625
— the blue band above.
At the midpoint, this role pays about
$184k
versus about
$185k
for comparable roles.
Based on 240 similar postings.
Employer
About Leidos
Leidos is an industry and technology leader serving government and commercial customers with smarter, more efficient digital and mission innovations.
Leidos currently has
426 open roles
on FindRole.
Listed pay typically runs
$92,300–$166,850
across 344 roles with salary data.
The Detection, Monitoring, & Countermeasures Lead serves as a senior Subject Matter Expert responsible for the operational management and technical optimization of the Security Operations Center's detection, triage, and prevention capabilities. This role leads a team of 10-15 staff in a 24/7/365 environment, overseeing the continuous monitoring of Pentagon networks. Key responsibilities include directing the tuning of security tools, developing countermeasures to mitigate risks, and identifying capability gaps within the J6 Pentagon sensor grid. The Lead will utilize technologies including SIEM platforms like Splunk, QRadar, and ArcSight, alongside IDS/IPS, firewalls, and endpoint security solutions like Trellix and MDE. The role addresses the technical problem of identifying malicious cyber activity, such as APTs and insider threats, while ensuring compliance with CJCSM 6510.01 and DoD/IC directives.
Lead 24/7 real-time monitoring and analysis of network and endpoint security data from the J6 Pentagon sensor grid.
Direct the identification, trending, and correlation of event data to detect malicious cyber activity and insider threats.
Manage the tuning and optimization of SIEM, IDS/IPS, and endpoint security tools to ensure optimal detection.
Develop and implement countermeasures to mitigate security risks and prevent adversary actions.
Evaluate current cyber defense technologies to identify capability gaps and shape requirements for future security operations.
Provide monthly reports to the government on system uptime, availability, maintenance, and vulnerability mitigation.
Supervise, mentor, and coach a team of 10-15 technical staff in a high-pressure environment.
Conduct active threat hunts aligned to the MITRE ATT&CK framework and perform forensic analysis to reconstruct attack timelines.
What we're looking for
Must possess an active Top-Secret clearance with SCI eligibility.
Requires a bachelor’s degree in IT or Cybersecurity with 12 to 15 years of experience, or a master’s degree with 10 to 13 years of experience.
Must have 5+ years of experience in incident handling or SOC operations.
Must have extensive experience operating, planning, and managing a SOC/CIRT.
Must have 3+ years of experience administering and deploying enterprise network defense tools like IDS/IPS, Packet Capture, SIEM, Proxy, and Web Content Filtering.
Must meet DoD 8140/8570.01-M requirements for IAT Level II prior to start.
Must obtain a CSSP Analyst certification (e.g., CEH, CySA+, GCIA, GCIH) within 180 days.
Must have subject matter expertise in SIEM platforms, endpoint security solutions, and modern security infrastructure.