Leidos Just Named 84 Cleared SOC Analysts. That's 37% of the Pool.

On September 28, 2026, Leidos filed a Virginia WARN notice for 84 Ashburn employees effective November 23. The trigger: Accenture Federal Services won a new $121.4M, five-year CBP Cyber Security Operations Center task order on GSA Alliant 2, bumping Leidos off a program it had held at 22001 Loudoun County Parkway. If you recruit cleared cyber talent and you are still searching "SOC Analyst Washington DC," you are going to lose this pool to three competitors who are searching the contract instead.

What just happened, in one paragraph

Leidos lost the U.S. Customs and Border Protection Cyber Security Operations Center recompete to Accenture Federal Services, and 84 cleared SOC staff in Ashburn are on the clock to find work by late November 2026. This is the second WARN at the same site in 2026. In January, Leidos filed on 93 workers at the same 22001 Loudoun County Parkway address. Combined 2026 cuts at that one facility: 177 cleared cyber workers.

The structural facts a sourcer needs:

• Filer: Leidos Holdings Inc, Reston, VA
• Site: 22001 Loudoun County Parkway, Ashburn, VA 20147
• Impact date: November 23, 2026
• Headcount: 84
• Program: CBP Cyber Security Operations Center support
• New incumbent: Accenture Federal Services (Arlington, VA)
• Contract: Award 70B04C26F00000527, RFP 70B04C26R00000035
• Vehicle: GSA Alliant 2
• Value: $121.4M over 5 years ($24.28M/year)
• Bidders: 6
• Effective: September 25, 2026
• Bumping rights: none, per Leidos

Leidos spokesperson Brandon Ver Velde told Virginia Business some workers "will likely join Accenture Federal Services" and others "are expected to join the company taking over the Customs and Border Protection program we lost." Read that carefully: Leidos itself is telling you a chunk of the 84 will not land at Accenture.

Why contract-keyword sourcing beats title sourcing

A keyword search for the specific program ("CBP SOC," "Customs and Border Protection Cyber," or the task-order ID family 70B04C) returns a smaller, higher-signal set than any title Boolean, because every match is pre-qualified by program experience. Title-based searches drown you in uncleared commercial SOC analysts in Dallas who will never pass a DHS suitability review.

In Refolk's index, the title-plus-clearance intersection ("SOC Analyst" or "Cyber Security Analyst" or "Security Ops" + TS/SCI or clearance skill) returns 226 U.S. profiles. The 84 Ashburn names are roughly 37% of that national pool. That is not a sourcing event. That is a market-making event.

37%

The mechanism behind why contract keywords beat titles in federal cyber:

1. Cleared professionals write their LinkedIn and resume around program names, not job titles, because contracting-officer evaluators recognize programs.
2. Titles get sanitized ("Cybersecurity Analyst III" could mean anything); program language ("CBP CSOC Tier 2," "DHS SOC," "EINSTEIN") is specific.
3. Clearance level is often implied by the program. If someone worked CBP CSOC, you already know the suitability package.
4. Commercial SOC noise disappears. Nobody in a Charter Communications NOC writes "70B04C" on their profile.

If you have only ever written title Booleans, this is the exact gap Refolk closes: you describe the person in plain English ("SOC analysts who worked the CBP CSOC program in Ashburn with active TS/SCI") and get a ranked shortlist, without translating that into GSA task-order IDs yourself.

The sizing table every cleared-cyber recruiter should pin

Here is the dataset to argue budget off of when you walk into a Monday pipeline meeting. Numbers come from the WARN filing, the contract notice, and Refolk's index.

Note the implied-seat math. A $24.28M/year ceiling at a rough $200K fully loaded rate suggests ~120 billable seats on the new Accenture contract. If Accenture rebadges 40 to 60 of the displaced Leidos staff (standard recompete behavior when the incumbent holds the specific DHS Suitability + active clearance), the gap of 30 to 50 cleared people with nowhere to land is the real recruiter opportunity.

Why "second WARN at the same site" is the most important fact in the filing

When a prime files two WARNs at the same facility inside twelve months on related work, the signal is that the whole line of business is leaving the address, which makes everyone still on site a flight-risk candidate. The 84 is a candidate list. The remainder of the Loudoun County Parkway cyber bench is a watch list.

Mechanism, in order:

1. January 2026: 93 cut at 22001 Loudoun County Parkway. Leidos says the facility is not closing.
2. September 2026: 84 more cut at the same address, same program family.
3. Cleared staff without bumping rights read filing two, calculate the trajectory, and start interviewing within 10 to 14 days.
4. Reinvestigation cycles reward speed. A cleared professional who waits three months to interview risks a crossover period where their SF-86 continuous evaluation flags "no sponsor."

That is why the real outreach window is 45 days, not the 60 the WARN clock suggests. For the September 28 filing, you have until roughly October 15, 2026 to catch the first-movers.

WARN gives you 60 days on paper. Cleared professionals move in 14.

The Accenture absorption math

Accenture Federal Services will cherry-pick cleared staff who match the exact DHS Suitability and active-poly profile the task order requires, and will pass on the rest. The leftover group is the actual recruiter opportunity, and nobody at Accenture is going to tell you who they are.

What Accenture typically keeps on a federal cyber rebadge:

• Current TS/SCI with recent (less than 24 months) investigation
• Active CI poly or full-scope poly if the task calls for it
• DHS Suitability already adjudicated
• GS-equivalent band that fits the proposal's labor categories
• On-site compatibility (CBP CSOC work is not remote-friendly)

What Accenture typically passes on:

• Lapsed poly
• Remote-only arrangements grandfathered under COVID
• Band mismatches (too senior for the proposed labor cat, or too junior)
• Specialists Leidos staffed for institutional continuity who are not in the new SOW

Accenture Federal already has a DHS cyber bench to absorb into: a $90M CISA data analytics contract from 2024 and a $112M CISA task order from 2021 to protect Federal Civilian Executive Branch systems. That matters because the firm has somewhere to park cleared staff who do not fit the exact CBP CSOC SOW but still hold value, which actually widens the pool of people they will make offers to. It also means the people they do pass on are passed on for real reasons, not capacity reasons. Those are the ones you want.

How to run this specific recompete as a sourcing play

Treat the WARN filing as a dated event with a 45-day window and build backwards from the outreach date, not forward from the layoff date. The outreach date is now.

A seven-step playbook for this exact event:

1. Pull the LinkedIn current-employer+location filter: Leidos, Ashburn VA, keyword "SOC" or "Cyber." That is your first-pass 84.
2. Cross-reference against program keywords in profiles: "CBP," "Customs and Border Protection," "CSOC," "70B04C." Expect dozens of exact hits, not hundreds.
3. Pull the January 93 cohort the same way, filtered to people who show "Open to work" or who have updated their headline since February.
4. Add the facility proxy. 22001 Loudoun County Parkway sits in a Verizon business complex; anyone whose profile location pins to Ashburn and whose employer is Leidos is in the building.
5. Score for Accenture-pass risk: lapsed poly indicators, remote-work mentions in current role, band mismatches.
6. Outreach by October 15 with a specific hook ("you do not need to wait on the Accenture rebadge decision").
7. Second-degree sweep on the 93 from January: who did they land with? Those employers are your talent-flow signal for the 84.

The structural lesson: federal recompetes are a sourcing calendar

Every losing bidder on a federal cyber task order generates a WARN or a quiet attrition wave inside 90 days, which means the Alliant 2, OASIS+, and CIO-SP4 task-order feeds are the leading indicator of cleared-talent liquidity. If you are not subscribed to orangeslices.ai or GovTribe for award notices, you are reading WARN notices three weeks after the people they name have already interviewed.

The baseline cleared-SOC pool is small. Refolk's index shows 226 U.S. profiles at the title-plus-clearance intersection, with concentration in Fort Belvoir, the DC-Baltimore corridor, Augusta GA, and San Antonio TX. The top employer buckets are the US Army (7) and US Air Force (5). That is it. A single 84-person WARN against a 226-person national pool is why you treat federal recompete announcements as a sourcing trigger, not a news item.

177

Two more entity names to anchor your outreach: Ron Ash is CEO at Accenture Federal Services, and Maurine Fanguy is the firm's managing director and CBP client lead. If you are placing displaced Leidos staff into other primes, those are the two names your candidates will mention. If you are placing them into non-Accenture competitors, you want to know which of your target employers have GTSC (Government Technology & Services Coalition) presence; that community is where losing-contract staff cluster during transitions.

FAQ

How do I verify the WARN filing myself?

Virginia Works publishes WARN notices at virginiaworks.gov/warn-notice/. The Leidos CBP SOC filing is notice 40516, filed 09/28/2026, impact 11/23/2026, site Ashburn. The January 93-person filing is on the same system. For contract validation, pull Award ID 70B04C26F00000527 on SAM.gov or GovTribe, or read the orangeslices.ai writeup on the Alliant 2 task.

What is the realistic recruiter window for the 84?

Roughly 45 days from the September 28 filing, which puts the practical closing date around October 15, 2026. Cleared professionals start interviewing inside two weeks of a WARN because clearance-reinvestigation cycles reward moving before your sponsor lapses. The 60-day WARN clock is a legal minimum, not a candidate-behavior reality.

Is Accenture Federal going to absorb all 84?

No. Leidos itself said some will join Accenture and others will land elsewhere. In federal recompete absorptions, winners typically rebadge 40 to 60% of the displaced cleared staff and pass on candidates with lapsed poly, remote-only arrangements, or band mismatches. Plan on 30 to 50 of the 84 having no landing spot by mid-October.

Why search contract keywords instead of job titles?

Cleared professionals write their profiles around program names (CBP CSOC, EINSTEIN, DHS SOC) because evaluators recognize programs, not generic titles. Title searches surface uncleared commercial analysts; program-keyword searches surface pre-qualified candidates. On this specific recompete, searching "CBP SOC" or "70B04C" returns dozens of exact-fit hits, versus hundreds of noisy title matches.