TS Mission Lead - SOC

Leidos

Confirmed live 2 days ago High trust

Quick summary

Work type: On-site
Location: Whitehall, OHShiloh, ILSunset, UT
Salary: $87,100–$157,450 / yr
Employment: Full-time
Posted: 13 days ago
Freshness: Confirmed live 2 days ago
Nearby: 99+ roles within 25 mi

Market check

Salary context

Below market

How this pay compares to similar roles

Similar $190k

This role $122k

$71k $238k

below market most similar roles pay here above market

This role pays less than 95% of similar roles. Most pay $158,000–$222,000 — the blue band above. At the midpoint, this role pays about $122k versus about $190k for comparable roles.

Based on 240 similar postings.

Employer

About Leidos

Leidos is an industry and technology leader serving government and commercial customers with smarter, more efficient digital and mission innovations.

Leidos currently has 399 open roles on FindRole.

Listed pay typically runs $92,300–$166,850 across 331 roles with salary data.

Most-posted roles

View all roles at Leidos

At a glance

TL;DR · TS Mission Lead - SOC

Role Posting Log in to save

The TS Mission Lead guides an operational team delivering 24x7 defensive cybersecurity monitoring and incident operations across Department of Defense Top Secret and classified enterprise networks. This role involves balancing tactical cyber threat intelligence, alert triaging, packet analysis, and high-impact incident response coordination with a focus on team development, coaching, and operational alignment. You will lead analysts in evaluating alerts from endpoints, IDS/IPS, NetFlow, and custom network sensors to identify and mitigate malicious activity. Key responsibilities include correlating multi-source log data to produce Cyber Incident Reports and integrating threat intelligence into SIEM platforms using MITRE ATT&CK and Cyber Kill Chain frameworks. Required skills include TCP/IP networking, Wireshark, and tcpdump. You must possess an active DoD Top Secret/SCI clearance and relevant IAT Level II or CSSP certifications.

Skills

Cybersecurity Monitoring Incident Response SIEM Splunk Elastic Sentinel Wireshark tcpdump TCP/IP IDS/IPS NetFlow MITRE ATT&CK Cyber Kill Chain Malware Analysis Packet Analysis DoD 8570 Security+ CySA+ CEH GCIA GCIH CISSP CASP+

What you'll do

Conduct bi-weekly 1-on-1 check-ins to provide career guidance and reduce team burnout.
Facilitate advanced technical training and certification pathways for analysts.
Lead analysts in triaging and investigating alerts from endpoints, IDS/IPS, and network sensors.
Correlate multi-source log data to produce detailed Cyber Incident Reports (CIR).
Integrate tactical threat intelligence feeds into SIEM platforms using MITRE ATT&CK frameworks.
Direct immediate containment actions and escalate critical incidents to DoD leadership and USCYBERCOM.
Manage shift coverage, training schedules, and mission readiness within the SCIF.

What we're looking for

Active DoD Top Secret / SCI security clearance.
Current DoD 8570/8140 IAT Level II baseline certification.
Current CSSP-A or CSSP-IR certification, or the ability to obtain within 180 days of hire.
Bachelor’s degree and 4 years of relevant operational cyber defense or SOC experience.
Bachelor’s degree and 8 years of relevant operational cyber defense or SOC experience.
Technical mastery of TCP/IP networking, packet analysis, the OSI model, and defense-in-depth principles.
100% on-site SCIF requirement and ability to reside within a 2-hour physical recall commute of Hill AFB, Scott AFB, or Columbus, OH.
Prior experience supporting DISA, DoD CSSP, or Service Cyber Components (preferred).

Save