Cyber Systems Engineer - level 5

Northrop Grumman•Colorado Springs, CO

4d•$177,000 - $265,600•Onsite

About The Position

Northrop Grumman's Space Sector is seeking a Cyber Systems Engineer - Level 5 to join their team in Colorado Springs, CO. This position will be based at their Colorado Springs airport facility. The role involves architecting, deploying, and maintaining the Elastic Stack, leading the design, deployment, configuration, and lifecycle management of Elastic Stack components. This includes owning version upgrades, patching, backup/restore strategies, and capacity planning. The engineer will develop automation for Elastic Stack deployments and configuration management using scripting and infrastructure-as-code tools, create reusable playbooks/scripts, and implement CI/CD-oriented approaches. Responsibilities also include defining and enforcing logging best practices, designing and optimizing Logstash pipelines and/or Elasticsearch ingest pipelines, integrating system and application metrics and SNMP traps, developing and implementing complex Elastic queries, and building Kibana dashboards, visualizations, and reports. The role supports security incident investigations and requires collaboration with cross-functional teams. Documentation of configurations, standards, procedures, and detection logic is also a key part of the role.

Requirements

Bachelor’s degree in a STEM field with 12 years of professional experience – OR – Master’s degree with 10 years of professional experience – OR – PhD with 8 years of professional experience
Must possess an active US Government Top Secret/SCI security clearance
Must possess, or be able to obtain within two (2) months of start, a DoD 8570 IAT Level II (or higher) certification (e.g., Security+ CE, CCNA-Security, GSEC, etc.).
Hands-on experience architecting, deploying, and maintaining Elastic Stack (Elasticsearch, Logstash, Kibana, Elastic Agent/Fleet/Defend) in a production environment, or similar experience performing advanced SIEM engineering duties in another enterprise SIEM platform such as Splunk or LogRhythm.
Proven experience designing and managing log and metric ingestion pipelines (Logstash and/or ingest pipelines) in a primarily Linux-based environment, or equivalent experience building and managing ingestion and parsing pipelines within another SIEM (e.g., Splunk, LogRhythm).
Demonstrated experience implementing logging best practices, including source configuration, normalization, and enrichment to support security monitoring and incident response.
Proficiency in building Kibana dashboards, visualizations, and complex queries using Elastic search languages (e.g., KQL, ES|QL, Lucene), or comparable experience creating dashboards, visualizations, and complex searches in other SIEM tools (e.g., Splunk SPL, LogRhythm search languages).
Experience troubleshooting issues related to data ingestion, indexing, and search performance in Elastic, or similar troubleshooting experience in another large-scale SIEM platform.
Strong background in Linux and solid working knowledge of Windows operating systems and applications.
Excellent analytical, problem-solving, and troubleshooting skills, with the ability to work independently and in a collaborative team environment.

Nice To Haves

US Government 8570 IAT Level III certification.
Elastic-specific or equivalent SIEM engineering certifications, such as: Elastic Certified Engineer, Elastic Certified Analyst, Elastic Certified Observability Engineer
Splunk Enterprise Certified Architect / Splunk Certified Engineer (or equivalent advanced Splunk certification)
Comparable advanced certifications for other SIEM platforms (e.g., LogRhythm Certified Professional/Engineer).
Experience designing and operating distributed and clustered Elastic environments at scale, or equivalent experience scaling and operating other enterprise SIEM platforms (e.g., Splunk, LogRhythm).
Demonstrated experience integrating metrics and SNMP traps into Elastic via Logstash and/or ingest pipelines, or similar integrations of metrics/SNMP traps into other SIEM tools.
Strong scripting skills with Python, Bash, PowerShell, or similar languages for automation, tooling, and data manipulation.
Experience implementing infrastructure-as-code approaches (e.g., Ansible, Terraform, or similar tools) for Elastic Stack deployments and configuration management.
Hands-on experience with: Syslog daemons (e.g., syslogd, rsyslog, syslog-ng)
Network security devices (routers, switches, firewalls, NAC, and related solutions)
Experience in a SOC, CSOC, or Cyber Defense environment supporting incident response, threat hunting, or detection engineering.
Proven ability to communicate clearly, both verbally and in writing, and to produce high-quality documentation and briefings.

Responsibilities

Architect, Deploy, and Maintain Elastic Stack
Lead the design, deployment, configuration, and lifecycle management of Elastic Stack components, including Elasticsearch, Logstash, Kibana, and Elastic Agent/Fleet/Defend in a primarily Linux-based environment.
Design and implement highly available, scalable, and secure Elastic Stack architectures across distributed and clustered environments.
Own version upgrades, patching, backup/restore strategies, and capacity planning for Elastic clusters.
Develop automation for Elastic Stack deployments and configuration management using scripting and/or infrastructure-as-code tools (e.g., Bash, Python, PowerShell, Ansible, Terraform, or equivalent).
Create reusable playbooks/scripts for provisioning new environments, onboarding new data sources, and performing configuration changes at scale.
Implement CI/CD-oriented approaches for safely deploying Elastic configuration, ingest pipelines, and detection logic.
Define and enforce logging best practices for Linux, Windows, network, and security devices to ensure high-fidelity, actionable telemetry.
Design, implement, and optimize Logstash pipelines and/or Elasticsearch ingest pipelines to onboard logs from diverse sources.
Normalize, enrich, and parse data (including use of regular expressions, grok, dissect, and ECS mapping) to support threat detection, hunting, and reporting use cases.
Integrate system and application metrics and SNMP traps into Elastic via Logstash and/or ingest pipelines.
Develop and maintain pipelines to transform metrics and SNMP events into structured documents suitable for dashboards, alerting, and long-term analysis.
Tune ingestion and storage strategies for performance, cost-efficiency, and retention requirements.
Develop and implement Complex Elastic queries to extract, analyze, and visualize security data from diverse sources.
Use Elastic search languages (KQL, ES|QL, Lucene, JQL, etc.) to support threat hunting, incident analysis, and operational monitoring.
Build and maintain Kibana dashboards, visualizations, and reports tailored to SOC analysts, incident responders, engineering teams, leadership, and auditors.
Leverage Elastic Defend to create and tune security use cases, correlation rules, and alerts to detect suspicious or malicious activity.
Monitor the health and performance of the Elastic environment; troubleshoot issues related to data ingestion, indexing, and search performance.
Support security incident investigations by rapidly querying Elastic data, pivoting across datasets, and providing forensic-quality evidence.
Collaborate with cross-functional teams (IT, network, application owners, and security operations) to onboard new data sources, implement logging requirements, and improve overall visibility.
Document Elastic configurations, logging standards, ingest pipelines, operational procedures, and detection logic. Provide clear technical documentation and briefings to both technical and non-technical stakeholders.