Cybersecurity Data Engineer - (306)

VAE•Adelphi, MD

15h•Hybrid

About The Position

VAE is seeking a Cybersecurity Data Engineer to design, build, and optimize data pipelines that support cyber defense operations on its C5ISR contract. The role works within the Elastic ecosystem to ensure high volumes of security logs and telemetry are ingested, enriched, and available for detection, threat analysis, and incident response. The engineer collaborates with Detection Engineering, Threat Analysis, Endpoint, and other cyber teams to turn raw data into mission-ready insight. This is a hybrid position requiring three days per week on-site at the Adelphi Laboratory Center (ALC) in Adelphi, Maryland.

Requirements

Active Top Secret clearance.
8570 certification.
Bachelor’s degree.
Hands-on experience administering and engineering solutions within the Elastic Stack, including Elasticsearch, Logstash, Kibana, and Fleet.
Experience building and maintaining ETL or data pipelines for log and telemetry data.
Working knowledge of index management, mappings, and data modeling.
Ability to work on-site at ALC in Adelphi, Maryland, three days per week.

Nice To Haves

Experience with Kafka, Python/Bash automation, CI/CD, or DevSecOps practices.
Experience working with Ruby.
Experience supporting AWS, Azure, GCP, Oracle Cloud, hybrid-cloud, or multi-cloud environments.
Knowledge of cybersecurity operations, including SIEM, threat detection, incident response, and security monitoring.

Responsibilities

Configure and optimize data ingestion, storage, and retrieval across the Elastic Stack (Elasticsearch, Logstash, Kibana, and Fleet) for high-volume, high-availability operations.
Design, maintain, and optimize scalable cybersecurity ETL pipelines using Elastic tools.
Develop transformations and enrichments for diverse security log and telemetry sources.
Maintain index templates, mappings, schemas, and data models that support analytics and detection logic.
Implement data validation, deduplication, and quality controls to ensure data integrity.
Automate ingestion, transformation, and engineering workflows using Python, Bash, and related tools.
Monitor pipeline and indexing performance, troubleshoot data-flow issues, and optimize throughput, storage, and query performance.
Maintain traceability and troubleshoot dependencies across Kafka, Elastic, and CI/CD tooling.
Partner with Detection Engineering, Threat Analysis, Endpoint, and other cyber teams to meet operational requirements.
Maintain technical documentation, SOPs, and engineering artifacts.