Elastic Security Engineer (SIEM)

SERVISS is a provider of cutting-edge cybersecurity and IT solutions, seeking an Elastic Security Engineer to support a Federal DoD SIEM program. The role involves designing, building, securing, and maintaining Elastic Stack solutions, while also automating processes and authoring technical documentation.

Responsibilities:

• Design, build, secure, maintain, optimize, and document multiple Elastic Stack enterprise solutions (Elasticsearch, Logstash, Kibana, Beats, Machine Learning, and SIEM) deployed globally in a Federal DoD environment
• Automate deployment and configuration using Ansible playbooks
• Perform continuous data-normalization functions across diverse data sources
• Build data pipelines and reporting automation that directly support internal engineering personnel and external customer requirements
• Author written technical deliverables such as SOPs and process workflows to optimize tool usage and contribute to new capabilities
• Support a Federal DoD SIEM program as part of a multi-disciplined engineering team
• Maintain, optimize, and secure enterprise Elastic Stack solutions deployed globally
• Contribute to new capabilities and the continuous improvement of tool usage
• Engage and collaborate across engineering teams and customer stakeholders

Requirements:

• Active Top Secret security clearance
• US citizenship
• Compliance with DoD 8140 / 8570 IAT Level II certification prior to start date
• At least 4 years of hands-on experience in deployment, configuration, and solution development using the Elastic Stack for security and logging use cases (Elastic SIEM experience a plus)
• Demonstrated experience with the full Elastic Stack: Elasticsearch, Logstash, Kibana, Beats, Machine Learning, and REST API integration
• Demonstrated ability to use Ansible playbooks
• Experience integrating Elasticsearch with external systems (e.g., SOAR tools, threat intelligence platforms)
• Experience with data management: hot/warm/cold architectures, shard allocation and re-allocation, snapshots and restoration
• Strong experience evaluating existing Elastic clusters, configuration parameters, indexing, search and query performance tuning, security, and cluster administration
• Experience integrating Elasticsearch with authentication mechanisms such as SAML, LDAP, and PKI
• Experience supporting the Elastic Stack in on-prem and SaaS environments, including system monitoring and tuning
• Experience securing the Elastic Stack and hardening hosting environments
• Development experience in multiple languages (Python, Bash, PowerShell, Painless, etc.)
• Experience designing and implementing highly scalable Elastic Stack solutions
• Experience developing data structures and data mappings from various sources to achieve data normalization using Elastic Common Schema (ECS)
• Experience developing Logstash and/or ingest pipelines
• Experience developing custom Kibana visualizations and dashboards
• Experience developing custom reporting solutions using APIs that leverage Elasticsearch and ElastiCache
• Experience with end-to-end low-level design, development, administration, and delivery of Elasticsearch-based reporting solutions
• Strong technical foundation in building reliable, scalable, and supportable systems
• Experience with Red Hat Enterprise Linux deployment and administration