SIEM Engineer

SAIC•Washington, DC

6d•Hybrid

About The Position

SAIC is seeking a SIEM Engineer to support enterprise cybersecurity operations and modernization of an agency's security monitoring and analytics capabilities. The role administers, engineers, and optimizes enterprise SIEM platforms in a mission-critical federal environment. The successful candidate brings hands-on SIEM administration experience and engineering and architectural knowledge, and can independently troubleshoot complex technical problems, improve platform performance and reliability, and contribute to scalable SIEM solutions. Strong analytical skills, technical curiosity, initiative, and commitment to continuous improvement are essential. The position supports enterprise platforms including Splunk Enterprise, Splunk ES, and Elastic / Elastic Security, as well as modernization efforts such as migration from Splunk to Elastic. It collaborates with security analysts, infrastructure teams, application owners, and cybersecurity leadership to improve visibility, detection capabilities, data quality, and operational reporting. The work arrangement is hybrid, with three days onsite and two days remote.

Requirements

Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical discipline, or equivalent relevant IT/cybersecurity experience.
9+ years of relevant IT or cybersecurity experience, including at least 3 years of hands-on SIEM administration, engineering, or enterprise logging experience.
Ability to obtain and maintain a Public Trust requiring U.S. Citizenship.
Demonstrated experience administering, engineering, or troubleshooting enterprise SIEM platforms, including hands-on Splunk Enterprise experience and working knowledge of Elastic or comparable search and analytics technologies.
Strong understanding of SIEM architecture, distributed systems, enterprise logging, data ingestion, parsing, normalization, indexing, retention, and performance optimization.
Proficiency with Splunk Search Processing Language (SPL), working knowledge of SQL, and familiarity with Elastic query technologies such as KQL, ES|QL, EQL, or Query DSL.
Experience onboarding and troubleshooting enterprise data sources, including Windows/Linux systems, network devices, security appliances, applications, and cloud environments.
Strong Linux and Windows administration skills, including working knowledge of networking, TCP/IP, DNS, HTTP/HTTPS, TLS, syslog, and related protocols.
Experience with scripting or automation using Python, PowerShell, Bash, REST APIs, or comparable technologies.
Familiarity with enterprise cybersecurity technologies such as EDR, firewalls, IDS/IPS, identity systems, vulnerability management, and security monitoring platforms.
Ability to independently investigate complex technical problems, analyze data, identify root causes, and develop practical engineering solutions.
Technical curiosity, initiative, accountability, and ability to learn new technologies while adapting to evolving enterprise requirements.
Excellent written and verbal communication skills, including the ability to document technical solutions and collaborate effectively with technical teams and leadership.

Nice To Haves

Hands-on experience with Elastic Stack / Elastic Security, including Elasticsearch, Kibana, Elastic Agent/Fleet, Beats, Logstash, and Elastic query technologies.
Experience with distributed or cloud-based SIEM architectures, including clustering, high availability, disaster recovery, storage optimization, and capacity planning.
Experience supporting enterprise SIEM migrations, particularly Splunk-to-Elastic, including data source migration, detection migration, and operational validation.
Advanced experience with Splunk Enterprise / Splunk ES, including distributed architectures, CIM, search optimization, and platform administration.
Experience with security detection engineering, correlation rules, alert tuning, MITRE ATT&CK, or security analytics development.
Familiarity with configuration management, Infrastructure-as-Code, Git, CI/CD, and automated platform deployments.
Experience supporting cybersecurity operations in federal environments and familiarity with NIST, FISMA, OMB, and FedRAMP requirements.
Relevant technical certifications such as Splunk Enterprise Certified Admin, Splunk Enterprise Certified Architect, Elastic Certified Engineer, Security+, CISSP, or comparable certifications.

Responsibilities

Administer, maintain, engineer, and optimize Splunk Enterprise, Splunk ES, and Elastic / Elastic Security platforms to ensure availability, performance, reliability, and scalability.
Support SIEM architecture and modernization initiatives, including Splunk-to-Elastic transition, data source and security use-case migration, infrastructure design, testing, validation, and operational cutover.
Design, configure, manage, and troubleshoot enterprise log collection and ingestion pipelines across syslog, Windows Event Collection/Forwarding, SIEM agents and forwarders, network devices, security technologies, applications, databases, and cloud services.
Onboard and normalize security telemetry, ensuring accurate collection, parsing, enrichment, indexing, retention, and searchability using standards such as Splunk CIM and Elastic ECS.
Develop, maintain, migrate, and optimize SIEM searches, dashboards, reports, alerts, correlation rules, and security detections using SPL, SQL, and Elastic query technologies.
Monitor and optimize SIEM infrastructure health, ingestion performance, storage utilization, system capacity, and data availability; support high availability, disaster recovery, and scalability requirements.
Troubleshoot SIEM and logging issues across the complete data path, identify root causes, and implement sustainable improvements to reliability and operational effectiveness.
Support SIEM architecture, configuration management, security hardening, change control, automation, and platform lifecycle management in accordance with enterprise and federal requirements.
Collaborate with security analysts, infrastructure teams, application owners, and cybersecurity leadership to improve security visibility, detection capabilities, data quality, and operational reporting.
Develop and maintain architecture diagrams, data flow diagrams, configuration standards, SOPs, and migration procedures, and provide technical guidance to other team members.
Evaluate emerging SIEM technologies and recommend engineering improvements that support performance, automation, scalability, and operational efficiency.
Take ownership of technical initiatives, communicate progress and risks, and independently drive technical issues and projects through resolution.