SIEM Architect

TIAG•Bethesda, MD

19h•$130,000 - $150,000•Hybrid

About The Position

TIAG is now hiring a SIEM Architect to support a modernization and transition initiative for a Uniformed Services University (USU) enclave. This position is based on at the customer site in Bethesda, MD in a hybrid capacity. This role directly supports SIEM Modernization and Cloud Transition at USU. As the technical lead, the SIEM Architect will guide a team of two Information Systems Security Engineers (ISSEs) to enable and oversee the transition of approximately 150 on-premise and cloud-hosted servers from a current Splunk Enterprise environment to a modern, Government-selected cloud-native SIEM platform. While Government-Furnished Labor (GFL) primarily performs server-level implementation, the Architect will oversee the end-to-end implementation process, provide deep technical enablement, and actively assist with hands-on implementation where needed to ensure project success.

Requirements

8–10+ years of overall cybersecurity and IT experience, with at least 5 years serving as a SIEM Architect, Senior Engineer, or technical implementation lead.
Demonstrated architectural and implementation expertise in deploying and optimizing Splunk Enterprise, Splunk Cloud, Microsoft Sentinel, and Google Chronicle.
Proven ability to lead a technical team (e.g., ISSEs, SOC analysts) while overseeing and assisting with large-scale log onboarding and transition projects.
Deep understanding of Federal and DoD compliance frameworks, including DISA STIGs, Risk Management Framework (RMF), and Zero Trust principles.
Proficiency in scripting and configuration management tools to design and deploy reusable implementation artifacts (GPOs, agent profiles).
Strong technical writing skills to produce comprehensive governance documentation, Logging Standards Manuals, and operational SOPs.
Ability to facilitate technical workshops, present comparative analyses to executive stakeholders, and deliver hands-on technical training to operations personnel.
Secret Clearance
CompTIA Security+ Certification

Responsibilities

Enable and oversee the implementation and transition of 150+ enterprise assets into the selected cloud-native SIEM environment.
Assist with hands-on server-level implementation, integration, and telemetry configuration where needed to bridge capability gaps and ensure project momentum.
Provide architectural vision and daily technical direction to two dedicated Information Systems Security Engineers (ISSEs) supporting the transition effort.
Serve as the primary technical escalation point for complex interoperability issues, delegating routine telemetry validation and parser configuration tasks to the ISSE team.
Lead the collaborative assessment of the current USU Splunk Enterprise environment, directing the ISSE team to document onboarded log sources, telemetry coverage, ingestion methods, and parser configurations.
Evaluate Government-Furnished Enterprise (GFE) SIEM platforms (Splunk Cloud, Microsoft Sentinel, Google Chronicle) against the enclave's operational, security, and modernization requirements.
Deliver a Platform Evaluation & Selection Report containing the formal technical recommendation for the platform best aligned with USU goals.
Develop a Security Configuration Baseline for the chosen SIEM solution that aligns with DoD cybersecurity requirements, DISA STIG guidance, RMF controls, and Zero Trust principles.
Establish enterprise-wide Logging Standards by analyzing operating system environments across the enclave.
Define comprehensive requirements for telemetry collection, event categorization, normalization, and retention in a finalized Logging Standards Manual.
Architect and build Reference Implementations for all supported OS categories, utilizing templates, scripts, Group Policy Objects (GPOs), and agent profiles.
Govern the ongoing transition of the 150+ enterprise assets, ensuring the ISSEs effectively deliver day-to-day Tier 2 technical support to GFL administrators for ingestion failures, parser inconsistencies, and connectivity issues.
Validate the telemetry pipelines established during implementation, ensuring the representative servers ("proving the pipe") demonstrate successful end-to-end event generation, ingestion, parsing, normalization, and visibility.
Oversee technical troubleshooting workflows, root cause analysis, and operational status reporting throughout the implementation lifecycle.
Design the operational governance framework for the future-state cloud-native monitoring environment.
Direct the ISSE team in authoring practical Standard Operating Procedures (SOPs) for Tier 1 GFL administrators.
Develop standardized methodologies for alert tuning, threshold tuning, suppression management, and false-positive handling to improve SOC efficiency.
Assess existing GFL cloud operations knowledge to design targeted "delta" training focused strictly on the unique features of the newly implemented SIEM solution.
Lead high-level instructional sessions on platform-specific querying (e.g., KQL for Microsoft Sentinel or UDM for Google Chronicle), while utilizing the ISSEs to facilitate hands-on labs.
Certify operational readiness by verifying that GFL personnel can independently sustain day-to-day SIEM operations post-implementation.