Elastic SIEM Engineer

ASRC Federal•Quantico, VA

2d•Hybrid

About The Position

ASRC Federal is hiring an Elastic SIEM Engineer to support its Defense Counterintelligence Security Agency (DCSA) program. The role maintains enterprise-scale Elastic Stack security solutions protecting national security systems. It designs and implements detection rules, correlation searches, and analytics pipelines with Elasticsearch, Logstash, Kibana, and Elastic Security to identify threats and adversary activity. The engineer optimizes ingestion from cloud platforms, network devices, endpoints, and security tools to support highly available, performant, scalable SIEM infrastructure. The role also develops dashboards, visualizations, and threat-hunting workbenches; collaborates with security operations, engineering teams, and government stakeholders; tunes detections to reduce false positives; automates workflows; integrates threat-intelligence feeds; and documents work to support NIST 800-53 and RMF compliance. Technical leadership is also expected. This is primarily a telework position, with onsite attendance required up to two days per week at Fort Meade, Maryland, according to the work-environment section. The posting's introductory section separately says onsite attendance up to one day per week at Hanover, Maryland. Flexible hours may be needed for security incidents, maintenance windows, and emergency response.

Requirements

At least five years of direct Elastic engineering or administration experience.
Active Secret clearance, with eligibility to be upgraded to TS/SCI.
Bachelor's degree in information security or a related field, or an equivalent combination of experience.
At hire, meet DoD 8140/8570 IAM or IAT Level II certification requirements with one of the following: CCNA Security, CySA+, GICSP, GSEC, Security+, SSSP, CAP, CASP CE, CISM, CISSP (or Associate), or GSLC.
Experience supporting and maintaining Elastic infrastructure in a highly available configuration in an AWS Cloud environment.
Proven experience as an Elastic Engineer or in a similar role.
Strong understanding of Elastic architecture in a cloud environment, including data ingestion, indexing, search, and visualization.
Experience customizing and configuring Elastic environments to client needs, including developing scripts and apps as needed.
Proficiency in Python or Bash for Elastic app and dashboard development.
Experience with data transformation and normalization for compatibility with Elastic.
Familiarity with networking principles and protocols.
Ability to analyze logs to identify potential security threats, including rogue or infected systems, unauthorized system changes, and unauthorized hardware connections.
Strong problem-solving skills and ability to work under pressure.
Strong communication and interpersonal skills, including ability to explain technical concepts to non-technical stakeholders.
For alternate worksites other than DCSA facilities or corporate office space, reliable voice communication (cell phone preferred) and a stable, capable internet connection.

Nice To Haves

Two or more years of AWS experience.

Responsibilities

Maintain enterprise-scale Elastic Stack security solutions.
Design and implement detection rules, correlation searches, and analytics pipelines using Elasticsearch, Logstash, Kibana, and Elastic Security.
Optimize data ingestion pipelines from cloud platforms, network devices, endpoints, and security tools.
Support high availability, performance, and scalability of SIEM infrastructure.
Develop custom dashboards, visualizations, and threat-hunting workbenches for SOC analysts.
Collaborate with security operations, engineering teams, and government stakeholders to enhance detection capabilities.
Tune detection logic to reduce false positives.
Automate security workflows and integrate threat-intelligence feeds.
Document work and ensure alignment with NIST 800-53 and RMF compliance standards.
Troubleshoot Elastic indexer, search-head, and forwarder problems.
Analyze network traffic, firewall, IDS, DNS, and ESS logs to identify potential security threats.
Support critical security incidents, maintenance windows, and emergency response activities as needed.