Elastic SIEM Engineer

ASRC Federal•Quantico, VA

16h•$120,000 - $165,450•Hybrid

About The Position

ASRC Federal is hiring an Elastic SIEM Engineer to support its Defense Counterintelligence Security Agency (DCSA) program. The position maintains enterprise-scale Elastic Stack security solutions that protect national security systems. The engineer designs and implements detection rules, correlation searches, and analytics pipelines using Elasticsearch, Logstash, Kibana, and Elastic Security to identify threats and adversary activity. The role also optimizes SIEM data ingestion from cloud platforms, network devices, endpoints, and security tools, and supports the availability, performance, and scalability of the infrastructure. The engineer develops dashboards, visualizations, and threat-hunting workbenches for SOC analysts; collaborates with security operations, engineering teams, and government stakeholders; tunes detection logic to reduce false positives; automates security workflows; and integrates threat intelligence feeds. The role includes documenting work and ensuring alignment with NIST 800-53 and Risk Management Framework (RMF) standards, as well as providing technical leadership. The position is primarily telework, with onsite attendance required at a specified Maryland worksite. The posting identifies Hanover, Maryland, with up to one onsite day per week in the position overview, and Fort Meade, Maryland, with up to two onsite days per week in the Work Environment section. A reliable voice communication method and stable, capable internet connection are required when working from an alternate worksite. Flexible hours may be needed for critical security incidents, maintenance windows, and emergency response activities. The posted salary range is $150,000 to $165,450, depending on experience and other factors.

Requirements

At least five years of direct Elastic engineering or administration experience.
Active Secret clearance, with eligibility to be upgraded to TS/SCI.
Bachelor’s degree in information security or a related field, or an equivalent combination of experience.
At hire, meet DoD 8140/8570 IAM or IAT Level II certification requirements through one of the listed certifications: CCNA Security, CySA+, GICSP, GSEC, Security+, SSSP, CAP, CASP CE, CISM, CISSP (or Associate), or GSLC.
Experience supporting and maintaining Elastic infrastructure in a highly available AWS Cloud configuration.
Proven experience as an Elastic Engineer or in a similar role.
Strong understanding of Elastic architecture in a cloud environment, including data ingestion, indexing, search, and visualization.
Experience customizing and configuring Elastic environments according to client needs, including developing scripts and apps as necessary.
Proficiency in scripting languages such as Python or Bash for Elastic app and dashboard development.
Experience with data transformation and normalization to ensure compatibility with Elastic.
Ability to troubleshoot Elastic indexers, search heads, and forwarder problems.
Familiarity with networking principles and protocols.
Strong problem-solving skills and ability to work under pressure.
Strong communication and interpersonal skills, including explaining technical concepts to non-technical stakeholders.
Experience analyzing network traffic, firewall, IDS, DNS, and ESS logs to identify possible security threats.
Ability to work flexible hours as needed for critical security incidents, maintenance windows, and emergency response activities.
For alternate worksites outside DCSA facilities or corporate office space, reliable voice communication and a stable, capable internet connection.

Nice To Haves

Two or more years of AWS experience.

Responsibilities

Maintain enterprise-scale Elastic Stack security solutions.
Design and implement detection rules, correlation searches, and analytics pipelines using Elasticsearch, Logstash, Kibana, and Elastic Security.
Optimize data ingestion pipelines from cloud platforms, network devices, endpoints, and security tools.
Support high availability, performance, and scalability of the SIEM infrastructure.
Develop custom dashboards, visualizations, and threat-hunting workbenches for SOC analysts.
Collaborate with security operations, engineering teams, and government stakeholders to enhance detection capabilities.
Tune detection logic to reduce false positives.
Automate security workflows and integrate threat intelligence feeds.
Document work and ensure activities align with NIST 800-53 and RMF compliance standards.
Provide technical leadership.
Customize and configure Elastic environments to meet client needs, including developing scripts and apps as necessary.
Troubleshoot Elastic indexers, search heads, and forwarder problems.
Analyze network traffic, firewall, IDS, DNS, and ESS logs to identify possible security threats, including rogue or infected systems and unauthorized changes or hardware connections.
Work flexible hours as needed to support critical security incidents, maintenance windows, and emergency response activities.