This role pays less than
66%
of similar roles. Most pay
$143,012–$212,800
— the shaded band above.
At the midpoint, this role pays about
$151k
versus about
$178k
for comparable roles.
Based on 240 similar postings.
Employer
About Leidos
Leidos is an industry and technology leader serving government and commercial customers with smarter, more efficient digital and mission innovations.
Leidos currently has
350 open roles
on FindRole.
Listed pay typically runs
$92,300–$166,850
across 299 roles with salary data.
The Endpoint Security Analyst – Elastic Defend joins the Cyber Security Service Provider team to provide specialized expertise in protecting critical networks and data. In this role, you will deploy, configure, tune, and troubleshoot Elastic Agent and Elastic Defend technologies while optimizing endpoint protection and telemetry collection across enterprise environments. You will collaborate with threat and engineering teams to develop detection rules, create threat signatures based on MITRE ATT&CK techniques, and conduct host-based defensive cyber operations to investigate and remediate intrusions. Your daily work involves building dashboards, managing security policies, and performing forensic data collection using advanced queries. The role requires proficiency in Elastic tools, potentially including experience with CrowdStrike Falcon, McAfee/Trellix ePO, or Tanium. You will solve complex security challenges by improving visibility and responding to emerging threats within a mission-critical infrastructure.
Deploy, configure, and troubleshoot Elastic Agent and Elastic Defend across enterprise environments.
Optimize endpoint protection and telemetry collection to improve security visibility while maintaining system performance.
Develop custom detection rules and threat signatures based on intelligence and MITRE ATT&CK techniques.
Conduct host-based defensive operations to identify, investigate, and remediate vulnerabilities or intrusions.
Perform forensic data collection and advanced querying to support cyber investigations and rapid containment.
Create dashboards and reports to provide leadership with visibility into enterprise security status.
Coordinate with engineering teams to manage patches, hotfixes, and critical security updates for endpoint tools.
Develop and maintain standard operating procedures (SOPs) and policies for endpoint security configurations.
What we're looking for
Bachelor's degree in a STEM field, cybersecurity, or a related field.
4+ years of relevant cybersecurity experience.
Hands-on experience deploying, configuring, and supporting enterprise endpoint security or EDR solutions.
Strong understanding of threat detection, incident investigation, and the MITRE ATT&CK framework.
U.S. citizenship and an active TS/SCI with SAP eligibility.
One of the following certifications: GIAC/SANS (GCIA, GCIH, GCFA, GCFE, GREM, GISF, GXPN, GWEB, GNFA, or GMON), Offensive Security (OSCP, OSCE, OSWP, or OSEE), ISC2 (CCFP or CISSP), or EC-Council (CEH, CHFI, LPT, ECSA, or ECI).
Experience with Elastic Agent and Elastic Defend, including deployment, configuration, and troubleshooting (preferred).
Experience with CrowdStrike Falcon, McAfee/Trellix ePO, Tanium, or other enterprise endpoint security platforms (preferred).