Security Engineer

Booz Allen Hamilton • Annapolis Junction, MD

5d • $112,800 - $257,000

About The Position

The Security Engineer designs, builds, and maintains systems that protect organizational data, networks, and IT infrastructure from cyberattacks, with a focus on proactive defense through secure architectures and automated defenses. The role manages infrastructure and cybersecurity controls, enhances detection and vulnerability capabilities, improves event correlation in large enterprises, and leads risk and vulnerability assessments across network, system, and application areas. It also uses big data analytics and traditional security events to identify advanced threats and indicators of compromise.

The position includes administering and scaling Elastic Stack security operations capabilities, developing dashboards and detection workflows, and designing log ingestion and normalization across varied sources. The engineer works with other teams and communicates security concepts to audiences ranging from technical colleagues to senior management. The role may involve supporting technical incident response, digital forensics, and damage mitigation.

Requirements

• At least 6 years of experience administering Elastic Stack, including Elasticsearch, Kibana, Logstash, Beats, or Fleet.
• Experience managing Elasticsearch index lifecycle policies, index templates, and data streams at scale, and building Kibana dashboards, visualizations, and lens-based analytics for security operations.
• Experience with Elastic Security detection rules, alerts, and case management workflows.
• Experience designing log ingestion pipelines, including parsing, enrichment, and normalization across heterogeneous network, endpoint, identity, and cloud sources.
• Experience with Elastic Common Schema (ECS) and mapping non-standard log sources into ECS-compliant fields.
• Experience with ES|QL or EQL for advanced threat hunting and detection-as-code workflows.
• Experience in a DoD, IC, or federal cybersecurity environment, such as SOC, SIEM operations, or defensive cyber.
• Secret clearance.
• High school diploma or GED.

Nice To Haves

• Experience building SOAR-related automation around Elastic, including webhook actions, connector integrations, or n8n or XSOAR orchestration.
• Experience with Elastic transforms and runtime fields for enriched security datasets and risk-scoring indices.
• Experience with RAG architectures or vector search in Elasticsearch for security knowledge retrieval, including TTP lookup and incident-context enrichment.
• Experience with Elastic ML jobs for use cases such as User and Entity Behavior Analytics (UEBA), rare process detection, or anomalous login patterns.
• Experience with Elastic AI Assistant or integrating LLMs into Elastic Security workflows, such as natural-language querying and alert-triage assistance.
• Experience building or fine-tuning ML models outside Elastic, including with Python, scikit-learn, and PyTorch, for security use cases such as threat detection or lateral-movement scoring.
• Knowledge of AI/ML concepts applied to security analytics, such as anomaly detection, behavioral baselining, or threat scoring.
• TS/SCI clearance.

Responsibilities

• Design and deploy firewalls, intrusion detection and prevention systems (IDS/IPS), and encryption protocols.
• Conduct penetration tests and security audits to identify and address system weaknesses.
• Perform Identity and Access Management (IAM), including implementing policies that restrict sensitive data access to authorized users.
• Lead or assist with technical responses to security breaches, including digital forensics and damage mitigation.
• Create and enforce company-wide security standards, including password management and data classification.
• Build relationships and communicate security complexities to other teams and audiences, including senior management.
• Manage infrastructure and cybersecurity controls, including enhanced detection and vulnerability capabilities and improved event correlation in large enterprises.
• Lead risk and vulnerability assessments across network, system, and application areas.
• Use big data analytics and traditional security event types to identify advanced threats and indicators of compromise.
• Administer Elastic Stack components and manage Elasticsearch index lifecycle policies, index templates, and data streams at scale.
• Build Kibana dashboards, visualizations, and lens-based analytics for security operations.
• Use Elastic Security detection rules, alerts, and case management workflows.
• Design log ingestion pipelines, including parsing, enrichment, and normalization across heterogeneous network, endpoint, identity, and cloud sources.
• Map non-standard log sources to Elastic Common Schema (ECS)-compliant fields.
• Use ES|QL or EQL for threat hunting and detection-as-code workflows.

Benefits

• Health, life, and disability benefits.
• Financial and retirement benefits.
• Paid leave.
• Professional development.
• Tuition assistance.
• Work-life programs.
• Dependent care.
• Recognition awards for exceptional performance and demonstration of company values.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: High school or GED