SIEM Administrator/Engineer

SAIC•Washington, DC

8d•Hybrid

About The Position

SAIC is seeking a SIEM Administrator / Engineer to support enterprise cybersecurity operations and the modernization of the agency's security monitoring and analytics capabilities. This position will provide hands-on administration of the organization's existing Splunk environment while helping transition security monitoring, log analytics, and detection capabilities to Elastic / Elastic Security. The ideal candidate has strong hands-on SIEM administration experience and is ready to grow into a broader engineering role. The successful candidate should be able to independently administer and troubleshoot production SIEM and logging infrastructure while demonstrating the technical curiosity, critical thinking, ownership, and initiative necessary to solve problems and improve the environment. This hybrid role requires a minimum of three on-site days per week in Washington, DC.

Requirements

Strong hands-on SIEM administration experience
Ability to independently administer and troubleshoot production SIEM and logging infrastructure
Technical curiosity, critical thinking, ownership, and initiative
Experience with Splunk Enterprise / Splunk ES
Experience with Elastic / Elastic Security
Experience configuring, managing, and troubleshooting enterprise log ingestion pipelines (syslog, Windows Event Collection/Forwarding, Splunk forwarders, Elastic agents, network and security devices, applications, databases, cloud services, and APIs)
Experience onboarding new data sources and ensuring telemetry is reliably collected, parsed, normalized, enriched, indexed, and searchable using applicable standards such as Splunk CIM and Elastic Common Schema (ECS)
Experience troubleshooting logging and telemetry issues across the complete data path
Experience developing, maintaining, and optimizing SIEM searches, dashboards, reports, alerts, and security detections using SPL and Elastic query technologies (KQL, ES|QL, EQL, and Query DSL)
Experience using SQL and other query languages to analyze data, validate results, troubleshoot integrations, and support cybersecurity investigations and reporting
Experience monitoring and optimizing SIEM platform health, performance, storage, ingestion, retention, and capacity
Experience working with security analysts and cybersecurity engineers to develop, test, tune, and improve security monitoring and detection capabilities
Experience investigating technical problems, testing hypotheses, identifying root causes, and implementing or recommending practical solutions
Experience using scripting, APIs, and automation where appropriate to improve SIEM administration, monitoring, data onboarding, and repetitive operational processes
Ability to maintain technical documentation and take ownership of assigned technical issues and projects through resolution.

Responsibilities

Administer, maintain, monitor, and troubleshoot the existing Splunk Enterprise / Splunk ES environment while supporting the implementation and operationalization of Elastic / Elastic Security.
Support the organization's transition from Splunk to Elastic, including migration and validation of data sources, searches, dashboards, reports, alerts, and security use cases.
Configure, manage, and troubleshoot enterprise log ingestion pipelines, including syslog, Windows Event Collection/Forwarding, Splunk forwarders, Elastic agents, network and security devices, applications, databases, cloud services, and APIs.
Onboard new data sources and ensure telemetry is reliably collected, parsed, normalized, enriched, indexed, and searchable using applicable standards such as Splunk CIM and Elastic Common Schema (ECS).
Troubleshoot logging and telemetry issues across the complete data path, from the originating system through collection, transport, ingestion, indexing, and search.
Develop, maintain, and optimize SIEM searches, dashboards, reports, alerts, and security detections using SPL and Elastic query technologies, including KQL, ES|QL, EQL, and Query DSL as applicable.
Use SQL and other query languages to analyze data, validate results, troubleshoot integrations, and support cybersecurity investigations and reporting.
Monitor and optimize SIEM platform health, performance, storage, ingestion, retention, and capacity.
Work with security analysts and cybersecurity engineers to develop, test, tune, and improve security monitoring and detection capabilities.
Investigate technical problems, test hypotheses, identify root causes, and implement or recommend practical solutions.
Use scripting, APIs, and automation where appropriate to improve SIEM administration, monitoring, data onboarding, and repetitive operational processes.
Maintain technical documentation and take ownership of assigned technical issues and projects through resolution.