Cybersecurity Data Engineer

SPECIAL AEROSPACE SECURITY SERVICES INC•Fort Meade, MD

1d•Hybrid

About The Position

The Cybersecurity Data Engineer configures and optimizes data ingestion, storage, and retrieval in the Elastic ecosystem—including Elasticsearch, Logstash, Kibana, and Fleet—to support high-volume, high-availability operations. The role designs, maintains, and optimizes scalable cybersecurity ETL pipelines; develops transformations and enrichments for security logs and telemetry; and maintains the index templates, mappings, schemas, and data models used for analytics and detection logic. The engineer implements data validation, deduplication, and quality controls; automates workflows using Python, Bash, and related tools; monitors and troubleshoots pipeline and indexing performance; and optimizes throughput, storage, and query performance. The role also maintains traceability across Kafka, Elastic, and CI/CD dependencies, collaborates with cybersecurity teams, and maintains technical documentation, SOPs, and engineering artifacts. The position requires three days on site at ALC in Adelphi, Maryland, and a TS clearance.

Requirements

TS clearance.

Nice To Haves

Experience with Kafka, Python/Bash automation, CI/CD, or DevSecOps practices.
Experience working with Ruby.
Experience supporting AWS, Azure, GCP, Oracle Cloud, hybrid-cloud, or multi-cloud environments.
Knowledge of cybersecurity operations, including SIEM, threat detection, incident response, and security monitoring.

Responsibilities

Configure and optimize data ingestion, storage, and retrieval within the Elastic ecosystem, including Elasticsearch, Logstash, Kibana, and Fleet.
Design, maintain, and optimize scalable cybersecurity ETL pipelines using Elastic tools.
Develop transformations and enrichments for security log and telemetry sources.
Maintain index templates, mappings, schemas, and data models supporting analytics and detection logic.
Implement data validation, deduplication, and quality controls to ensure data integrity.
Automate ingestion, transformation, and engineering workflows using Python, Bash, and related tools.
Monitor pipeline and indexing performance; troubleshoot data-flow issues; and optimize throughput, storage, and query performance.
Maintain traceability and troubleshoot dependencies across Kafka, Elastic, and CI/CD tooling.
Partner with Detection Engineering, Threat Analysis, Endpoint, and other cybersecurity teams to support operational requirements.
Maintain technical documentation, SOPs, and engineering artifacts.