E-Discovery Administrator (Security/FOIA/CAPSTONE)

The Leidos Digital Sector is seeking a highly skilled and experienced E-Discovery Administrator (Security/FOIA/CAPSTONE) to perform tasks associated with legal discovery (eDiscovery), litigation support, and secure data archival across IL4, IL5, and IL6 environments.

About Leidos

• At Leidos, we deliver innovative solutions guided by our commitment to deliver mission success for our customers.
• Our Mission, Vision, and Values guide the way we do business serving government and commercial customers with smarter, more efficient digital and mission innovations.
• At Leidos, we outthink, outbuild, and outpace the status quo — because the mission demands it.
• We're not hiring followers.

Responsibilities

• This role will respond to reported electronic spillage involving classified or controlled information by conducting initial assessments, coordinating with security personnel, executing approved containment and remediation procedures, documenting all actions taken, supporting incident reporting, and recovery activities to minimize operational impact and ensure continued compliance with security and regulatory requirements.
• Take administrative action in response to reported electronic spillages of classified data, to include content search, quarantine, creating archival copies, and/or deletion of data.
• Assist DON attorneys in responding to subpoenas, discovery requests, court orders, and other matters related to litigation.
• Enable/disable user accounts based on information assurance events in coordination with Information Systems Security Managers.
• Provide knowledgeable and skilled in FOIA, Privacy, and records management processing (analyzing requests and exemptions, writing correspondence, managing workload).
• Conduct audits of various security elements of the IL6 tenant covering topics such as vulnerability remediation, endpoint security posture, Conditional Access Policies, role assignments and trust relationships.
• Manage and operate cloud based Comply to Connect/Enhanced Network Access Control (eNAC) system (e.g., design and implement policies, attend DoD level forums to capture requirements).
• Support personnel investigations and litigation-related account requests and data delivery.
• Manage infrastructure devices (e.g., routers, switches, Firewalls) that support Splunk.

Requirements

• Requires a current Top Secret Security Clearance.
• Requires a BA degree with 4 – 8 years of prior relevant experience or Master’s degree with 2 – 6 years’ experience with Microsoft 365 Admin Center.
• Azure Fundamentals Certification.
• Microsoft 365 Fundamentals Certification.
• Microsoft Security, Compliance, and Identity Fundamentals Certification.
• Completion of Federal Law Enforcement Training Center Digital Forensics Levels 1 and 2 or equivalent Digital Forensic Examiner certification.
• Experience with Microsoft Intune.
• Experience with ACAS server maintenance and configuration.
• Understanding of cloud computing and networking.
• Experience supporting Splunk.
• Experience as a Microsoft Exchange, Teams, SharePoint, and OneDrive Administrator.
• Knowledge of the Information Technology Infrastructure Library (ITIL) Framework.
• We're recruiting the ones who disrupt, provoke, and refuse to fail.
• Step 10 is ancient history.
• We're already at step 30 — and moving faster than anyone else dares.

Pay

Pay Range $65,650.00 - $118,675.00 The Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary.

Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.

If you're looking for comfort, keep scrolling.

Original Posting

October 21, 2026 For U.S. Positions: While subject to change based on business needs, Leidos reasonably anticipates that this job requisition will remain open for at least 3 days with an anticipated close date of no earlier than 3 days after the original posting date as listed above.