Cyber Data Analysis Engineer (Elasticsearch & SIEM)

Socket.dev; Town of Springfield (WI); On-site; USD 82,000 - 172,000; Full time

Job summary

Socket.dev in the United States is seeking a Cyber Data Analysis Engineer (Elasticsearch) to design, build, and maintain enterprise log data pipelines and SIEM environments across on-prem and cloud. The role emphasizes governance, documentation, and teamwork in a mission-focused setting.

Qualifications include TS/SCI clearance (or ability to pass polygraph), a CS/IT degree with 6+ years, and hands-on SIEM experience with Elasticsearch, ArcSight, Splunk or Sentinel. Some travel may be required.

Qualifications

• Active TS/SCI clearance with polygraph or ability to pass.
• Bachelor's degree or equivalent experience with 6+ years in related field.
• DOD 8570 IAT Level II certification required.
• Ability to obtain CSSP Infrastructure Support Certification within 90 days.
• 3+ years Unix/Linux server administration; 2+ years Windows server admin.
• 2+ years SIEM administration (Elasticsearch, Splunk, Sentinel, ArcSight).
• Strong written and spoken communication skills.

Responsibilities

• Design, build, and maintain log data collection pipelines across environments.
• Manage log data collection using Cribl, ArcSight, Kafka, AWS, Linux and Windows servers.
• Develop log data management using Elasticsearch or Sentinel.
• Troubleshoot data flow from SIEM data collection to storage/display.
• Perform root cause analysis for complex issues and ensure uptime.
• Create indicators of system health to monitor platform.
• Document tasks, processes, changes, and product statuses.
• Provide team training and interact with customers throughout projects.

Skills

Team collaboration

Documentation

Detail-oriented

Knowledge sharing

Education

Bachelor's Degree in Computer Science/Information Technology or related field

DOD 8570 IAT Level II Certification

CSSP Infrastructure Support Certification within 90 days

Tools

Elasticsearch

Sentinel

ArcSight

Splunk

Kafka

Cribl

AWS

Job description

Socket.dev in the United States is seeking a Cyber Data Analysis Engineer (Elasticsearch) to design, build, and maintain enterprise log data pipelines and SIEM environments across on-prem and cloud. The role emphasizes governance, documentation, and teamwork in a mission-focused setting.

Qualifications include TS/SCI clearance (or ability to pass polygraph), a CS/IT degree with 6+ years, and hands-on SIEM experience with Elasticsearch, ArcSight, Splunk or Sentinel. Some travel may be required.