Cyber Data Engineer: Elasticsearch & SIEM Expert

Worky; Springfield (VA); On-site; USD 82,000 - 172,000; Full time

Job summary

CACI is seeking a Cyber Data Analysis Engineer (Elasticsearch) to design, build, and maintain enterprise log data pipelines and SIEM environments for government contracts. You will work with Cribl, ArcSight, Kafka, AWS, Linux, and Windows systems to collect, store, and display data critical to cybersecurity missions.

You will collaborate with customers, document processes, and provide training while ensuring compliance with security policies.

Qualifications

• Active TS/SCI clearance with polygraph ability.
• Bachelor's degree with 6+ years of relevant experience or equivalent experience.
• DOD 8570 IAT Level II Certification.
• Ability to obtain CSSP Infrastructure Support Certification within 90 days of hire.
• 3+ years Unix/Linux Server Administration.
• 2+ years Windows Server Administration.
• 2+ years SIEM administration (Elasticsearch, Splunk, Sentinel, ArcSight, etc.).
• Strong oral and written communications.
• Good listening and comprehension.

Responsibilities

• Help customers send their log data through enterprise networks to a destination.
• Design, build, and maintain log data pipelines using Cribl, ArcSight, Kafka, AWS, Linux, and Windows servers.
• Design, build, and maintain log data management environments with Elasticsearch or Sentinel.
• Research resources needed to optimize support for Linux systems or hosted products.
• Troubleshoot data flow issues from SIEM data collection to SIEM or storage.
• Troubleshoot data display or storage issues within the SIEM environment.
• Perform root cause analysis for complex issues.
• Design indicators of system health to maximize uptime and monitor the platform.
• Maintain appropriate application, system, and product versions per policy.
• Develop or improve processes using scripts, Ansible, or AWS products.
• Document tasks, processes, changes, and product statuses.
• Provide team training regarding tasks and products.
• Interact with internal and external customers during all project phases.
• Be aware of customer needs and respond promptly to inquiries.
• Demonstrate attention to detail.
• On-call duties including nights/weekends (very rare).

Skills

Clearance awareness

Team collaboration

Documentation

Attention to detail

Unix/Linux Server Admin

Windows Server Admin

SIEM administration

Scripting/Automation

Communication skills

Education

Bachelor's Degree in CS/IT or related field

DOD 8570 IAT Level II Certification

CSSP Infrastructure Support Certification (within 90 days)

Tools

Cribl

ArcSight

Kafka

Elasticsearch

Sentinel

AWS

Linux

Microsoft Windows servers

Ansible

YAML

Python

JavaScript

Bash

Ruby

Job description

CACI is seeking a Cyber Data Analysis Engineer (Elasticsearch) to design, build, and maintain enterprise log data pipelines and SIEM environments for government contracts. You will work with Cribl, ArcSight, Kafka, AWS, Linux, and Windows systems to collect, store, and display data critical to cybersecurity missions.

You will collaborate with customers, document processes, and provide training while ensuring compliance with security policies.