Senior Elastic Stack Data Integration Engineer IRES - SSFB/HSV

Amentum•Colorado Springs, CO

8d•$140,000 - $160,000•Onsite

About The Position

The Senior Elastic Stack Data Integration Engineer serves as the primary technical authority for designing, building, and maintaining data ingestion pipelines that support Elastic SIEM. The role centers on creating scalable, resilient Logstash architectures; developing advanced pipeline logic; normalizing, enriching, and transforming security telemetry; and reliably delivering high-fidelity data to Elasticsearch. The position is onsite at Schriever Space Force Base in Colorado Springs, Colorado, or Redstone Arsenal in Huntsville, Alabama. Remote work is not available. The role requires an active DoW Secret clearance and the ability to obtain and maintain a DoW Top Secret clearance. Travel may be required up to 10% of the time. The engineer works with SIEM integration, detection engineering, infrastructure, and platform operations teams to align data pipelines with customer logging needs, analytics coverage, deployment, scaling, and reliability requirements. The role also establishes ingestion standards, supports audits, documents data handling, and drives pipeline architecture decisions. The position requires at least four years of general full-time work experience, which may be reduced with advanced education; at least three years of directly related experience; and at least two years in a management or leadership role. Compensation is listed as $140,000–$160,000. The company states that actual compensation may vary based on job responsibilities, education, experience, skills, internal equity, market data, applicable agreements, and relevant laws. Benefits may vary by employment type, location, and applicable agreements.

Requirements

At least 4 years of general full-time work experience; this requirement may be reduced with completion of advanced education.
At least 3 years of directly related experience in log ingestion, data engineering, or SIEM pipeline development.
At least 2 years of experience in a management or leadership role.
Strong background in Elastic Stack components, including Elasticsearch, Kibana, Beats, and Elastic Agent.
Experience with data ingestion, processing, and enrichment techniques.
Hands-on experience ingesting, processing, and normalizing diverse log types, including Windows events, syslog, firewall logs, cloud telemetry, and security tooling.
Proficiency in Linux administration, system-level debugging, and CLI-based operations.
DoD 8570.01-M IAT Level II certification with Continuing Education (CE), such as CCNA-Security, CySA+, GICSP, GSEC, Security+ CE, CND, or SSCP.
Active DoW Secret Security Clearance.
Ability to obtain and maintain a DoW Top Secret Security Clearance.
Deep command of Logstash architecture, patterns, and performance optimization.
Mastery of parsing, enrichment, normalization, and ECS alignment.
Strong understanding of network protocols, logging patterns, and telemetry generated by enterprise systems.
Advanced troubleshooting skills across data ingestion, pipeline logic, and Elastic Stack processing layers.
Ability to design scalable, high-availability ingestion workflows with clear operational boundaries.
Ability to conduct data modeling, schema design, and transformation mapping.
Ability to interface with multiple teams, gather requirements, and align pipeline designs with SIEM analytics needs.
Focus on reliability, maintainability, and observability across pipeline components.
Strong attention to detail and disciplined documentation, versioning, and configuration management.
Strong documentation, workflow diagramming, and communication skills.
Submit a resume using month-and-year date format with the application.

Nice To Haves

Elastic Certified Engineer credential or relevant Elastic Stack certifications.
Experience integrating Kafka, Redis, or other message-bus technologies into ingestion workflows.
Scripting proficiency in Python, Bash, or PowerShell for automation and data validation.
Experience designing geo-distributed or multi-cluster ingestion architectures.
Knowledge of threat intelligence ingestion, correlation data enrichment, and advanced ECS mapping.
Experience with CI/CD pipelines, GitOps workflows, or Infrastructure-as-Code tools such as Terraform or Ansible.
Familiarity with data quality assurance frameworks and pipeline testing methodologies.
Knowledge of cloud-native logging architectures such as AWS Firehose, Azure Event Hub, and GCP Logging.

Responsibilities

Architect, build, and maintain Logstash pipelines for ingesting and transforming logs from network devices, servers, cloud services, and security platforms.
Implement parsing, grok patterns, JSON transformations, conditional routing, enrichment logic, and ECS mapping.
Optimize pipeline performance, resiliency, and scalability, including persistent queues, pipeline workers, memory tuning, and load balancing.
Ensure ingested data conforms to ECS or internal schema requirements.
Implement data enrichment workflows, including GeoIP, threat intelligence lookups, and metadata injection.
Validate completeness, integrity, and fidelity of data across ingestion flows.
Maintain and optimize Logstash clusters, including version management, scaling, tuning, and high-availability configurations.
Manage integrations with Beats, Elastic Agent, Kafka, syslog endpoints, and custom data collectors.
Monitor ingestion throughput, latency, and error rates, and implement proactive alerting and troubleshooting processes.
Create and maintain technical documentation, including pipeline diagrams, data flow maps, runbooks, and schema references.
Establish enterprise standards for parsing, enrichment, normalization, and ingestion patterns.
Support internal and external audits by documenting data handling flows and pipeline logic.
Work with SIEM integration engineers to align pipelines with customer environments and logging requirements.
Partner with detection engineering teams to ensure data supports analytic coverage and rule development.
Collaborate with infrastructure and platform operations teams on deployment, scaling, and reliability engineering.
Drive pipeline architecture decisions, work independently, and mentor junior engineers.