Vulnerability Analysis Subject Matter Expert (SME)

Assess vulnerability applicability and actual organizational risk using CVSS, CISA KEV, EPSS, vendor advisories, available exploits, threat intelligence, system exposure, architecture, compensating controls, and mission impact. The SME will evaluate vulnerabilities within the context of the operating environment and make defensible, risk-based determinations based on technical severity, exploitability, threat intelligence, system architecture, existing security controls, mission criticality, and potential impact.

Description

The Digital Sector at Leidos currently has an opening for a Vulnerability Analysis Subject Matter Expert (SME)to work in our Lorton, VA office.

This is an exciting opportunity to use your experience helping the Homeland Enterprise Information Technology Secure Services & Support (HEITS) Program contracted mission.

Primary Responsibilities.

The Vulnerability Analysis Subject Matter Expert (SME) serves as a senior technical authority for vulnerability identification, analysis, prioritization, remediation, and risk assessment across sensitive and classified information systems.

The SME will evaluate vulnerabilities within the context of the operating environment and make defensible, risk-based determinations based on technical severity, exploitability, threat intelligence, system architecture, existing security controls, mission criticality, and potential impact.

The position requires both deep technical knowledge and cybersecurity risk-management experience. The SME must be capable of translating technical vulnerability information into actionable recommendations for engineers, system owners, cybersecurity personnel, and senior leadership.

Key Responsibilities:

Perform detailed analysis of vulnerabilities affecting enterprise systems, applications, network infrastructure, operating systems, virtualization platforms, and security appliances.

Assess vulnerability applicability and actual organizational risk using CVSS, CISA KEV, EPSS, vendor advisories, available exploits, threat intelligence, system exposure, architecture, compensating controls, and mission impact.

Research emerging and zero-day vulnerabilities and determine potential impact to organizational systems; recommend appropriate remediation, mitigation, monitoring, or risk-acceptance actions.

Administer and maintain enterprise vulnerability assessment and management technologies, including Tenable Security Center/Tenable.sc, Nessus, or comparable platforms.

Develop and manage credentialed vulnerability scanning strategies and troubleshoot scan coverage, authentication, connectivity, and accuracy issues.

Monitor government, commercial, vendor, and open-source cyber threat intelligence and initiate appropriate vulnerability analysis and response activities. Identify false positives, non-applicable findings, superseded vulnerabilities, and scanner limitations requiring additional technical analysis.

Work with system administrators, engineers, ISSOs/ISSMs, and system owners to validate findings and develop practical remediation or compensating-control strategies.

Basic Qualifications:

Bachelor's degree in Cybersecurity, Information Assurance, Computer Science, Information Systems, Engineering, or related discipline; or an equivalent combination of education, professional training, certifications, and relevant experience.

Active TS/SCI security clearance is required.

Significant progressively responsible experience in IT, cybersecurity, information assurance, security engineering, vulnerability management, or cyber operations.

Demonstrated experience supporting cybersecurity or risk-management activities within sensitive, classified, National Security System, DoD, Intelligence Community, or comparable high-security environments.

• Demonstrated experience with enterprise vulnerability assessment and management technologies.

• Working knowledge of NIST RMF, NIST SP 800-53, CNSSI, continuous monitoring, vulnerability management, POA&M management, and security authorization activities.

• Demonstrated ability to independently analyze technical vulnerabilities and make risk-based recommendations rather than relying solely on automated scanner severity ratings.

• Experience with UIPath or similar automation tools and automation solution development

• Strong understanding of Windows and Linux operating systems, enterprise networking, security architecture, authentication, virtualization, and common enterprise security technologies.

• Ability to communicate complex technical cybersecurity issues and risk determinations effectively to engineers, system owners, cybersecurity leadership, and senior decision-makers.

• Support RMF, Assessment and Authorization (A&A), continuous monitoring, POA&M management, security assessments, and risk-acceptance activities for National Security Systems (NSS) and other sensitive/classified environments.

• Apply NIST SP 800-53, CNSSI 1253, ICD 503, DISA STIGs/SRGs, and other applicable federal and Intelligence Community cybersecurity requirements.

• Integrate vulnerability information with other enterprise security capabilities, including SIEM, logging, endpoint security, and threat intelligence platforms, to improve risk analysis and situational awareness.

• Develop vulnerability metrics, trend analyses, technical assessments, and executive-level reporting and provide defensible recommendations to technical and senior leadership.

• Serve as a trusted technical advisor and provide guidance and mentorship to cybersecurity analysts, engineers, and system administrators.

Preferred Qualifications:

Master's degree in Cybersecurity, Information Assurance, Computer Science, Information Systems, Engineering, or related discipline.

CISSP, CISM, or comparable advanced cybersecurity certification; multiple advanced cybersecurity certifications are highly desired.

Current DHS Entry on Duty (EOD) suitability/clearance.

• Experience supporting multiple National Security Systems (NSS) and complex accreditation environments.
• Extensive experience with NIST SP 800-53, CNSSI 1253, ICD 503, DISA STIGs/SRGs, and federal or Intelligence Community cybersecurity requirements.
• Experience administering or integrating enterprise cybersecurity technologies such as Tenable Security Center/Tenable.sc, Nessus, Splunk, SIEM, endpoint security, or related platforms.
• Experience as an ISSE, ISSM, or senior ISSO.
• Experience with cross-domain solutions and security architectures spanning multiple security boundaries.
• Experience leading or providing technical oversight of enterprise cybersecurity operations.
• Knowledge of MITRE ATT&CK and adversary tactics, techniques, and procedures.
• Experience with incident response, threat hunting, cyber operations, or adversary emulation.
• Experience with Windows Server, Linux, Active Directory, network infrastructure, virtualization, and enterprise security technologies.
• Experience developing and presenting technical risk recommendations to senior government and program leadership.
• Strong critical-thinking, problem-solving, technical research, and written communication skills.

If you're looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo — because the mission demands it. We're not hiring followers. We're recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We're already at step 30 — and moving faster than anyone else dares.

Original Posting:

September 17, 2026

Pay Range:

Pay Range $131,300.00 - $237,350.00

The Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.

About Leidos

Leidos is an industry and technology leader serving government and commercial customers with smarter, more efficient digital and mission innovations. Headquartered in Reston, Virginia, with 47,000 global employees, Leidos reported annual revenues of approximately $16.7 billion for the fiscal year ended January 3, 2025. For more information, visit www.Leidos.com.

Pay and Benefits

Pay and benefits are fundamental to any career decision. That's why we craft compensation packages that reflect the importance of the work we do for our customers. Employment benefits include competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement. More details are available at www.leidos.com/careers/pay-benefits.

Securing Your Data

Beware of fake employment opportunities using Leidos’ name. Leidos will never ask you to provide payment-related information during any part of the employment application process (i.e., ask you for money), nor will Leidos ever advance money as part of the hiring process (i.e., send you a check or money order before doing any work). Further, Leidos will only communicate with you through emails that are generated by the Leidos.com automated system – never from free commercial services (e.g., Gmail, Yahoo, Hotmail) or via WhatsApp, Telegram, etc. If you received an email purporting to be from Leidos that asks for payment-related information or any other personal information (e.g., about you or your previous employer), and you are concerned about its legitimacy, please make us aware immediately by emailing us at LeidosCareersFraud@leidos.com.

If you believe you are the victim of a scam, contact your local law enforcement and report the incident to the U.S. Federal Trade Commission.

Commitment to Non-Discrimination

All qualified applicants will receive consideration for employment without regard to sex, race, ethnicity, age, national origin, citizenship, religion, physical or mental disability, medical condition, genetic information, pregnancy, family structure, marital status, ancestry, domestic partner status, sexual orientation, gender identity or expression, veteran or military status, or any other basis prohibited by law. Leidos will also consider for employment qualified applicants with criminal histories consistent with relevant laws.