Data Engineer (Python Application Development – NOT ETL-Focused)

SASSI; Leesburg (VA); Hybrid; USD 120,000 - 150,000; Full time

Job summary

SASSI is seeking a cybersecurity-focused Data Engineer in Leesburg, VA to build and optimize an Elastic-based data pipeline environment. This hybrid role emphasizes Python application development and end-to-end ownership, with active TS clearance requirements tied to the work.

You will configure ingestion, storage, and retrieval across Elasticsearch, Logstash, Kibana, and Fleet, design scalable cybersecurity data pipelines, develop transformations for security logs, and automate workflows using

Qualifications

• U.S. Citizen with Active TS Clearance required.
• 5 years Python application development.
• 5 years Streamlit application development.
• 5 years Docker containerization.
• 5 years deploying and troubleshooting containerized applications.
• 5 years integrating data into applications using SQL, APIs, and files.
• 5 years owning applications end-to-end.
• Willingness to travel 25%.

Responsibilities

• Configure and optimize data ingestion, storage, and retrieval within Elasticsearch stack.
• Design scalable cybersecurity data pipelines using Elastic tools.
• Develop transformations and enrichments for security logs and telemetry sources.
• Maintain index templates, mappings, schemas, and data models for analytics and detection logic.
• Implement data validation, deduplication, and quality controls to ensure data integrity.
• Automate ingestion, transformation, and engineering workflows using Python, Bash, and related tooling.
• Monitor pipeline and indexing performance, troubleshoot data-flow issues, and optimize throughput, storage, and query performance.
• Maintain traceability and troubleshoot dependencies across Kafka, Elastic, and CI/CD tooling.
• Partner with Detection Engineering, Threat Analysis, Endpoint, and other cyber teams to support operational requirements.
• Maintain technical documentation, SOPs, and engineering artifacts.
• 3 days on site at ALC, Adelphi MD.

Skills

Python development

Streamlit development

Docker containerization

Containerized applications

SQL

APIs

End-to-end ownership

Travel readiness

Tools

Elasticsearch

Logstash

Kibana

Fleet

Kafka

CI/CD

Job description

SASSI is seeking a cybersecurity-focused Data Engineer to build and optimize an Elastic-based data pipeline environment. This hybrid role in Leesburg, VA emphasizes Python application development and end-to-end ownership, with active clearance requirements tied to the work.

You will configure ingestion, storage, and retrieval across the Elastic ecosystem, while also developing containerized applications and automating workflows that support high-volume, high-availability operations.

Role focus

• Configure and optimize data ingestion, storage, and retrieval within Elasticsearch, Logstash, Kibana, and Fleet to support high-volume and high-availability operations.
• Design, maintain, and optimize scalable cybersecurity data pipelines using the Elastic suite of tools.
• Develop transformations and enrichments for security log and telemetry sources.
• Maintain index templates, mappings, schemas, and data models that support analytics and detection logic.
• Implement data validation, deduplication, and quality controls to ensure data integrity.
• Automate ingestion, transformation, and engineering workflows using Python, Bash, and related tooling.
• Monitor pipeline and indexing performance, troubleshoot data-flow issues, and optimize throughput, storage, and query performance.
• Maintain traceability and troubleshoot dependencies across Kafka, Elastic, and CI/CD tooling.
• Partner with Detection Engineering, Threat Analysis, Endpoint, and other cyber teams to support operational requirements.
• Maintain technical documentation, SOPs, and engineering artifacts.
• 3 days on site at ALC, Adelphi MD.

Required qualifications

• U.S. Citizen with Active TS Clearance REQUIRED.
• Python application development (5 years).
• Streamlit application development (5 years).
• Docker containerization (5 years).
• Deploying and troubleshooting containerized applications (5 years).
• Integrating data into applications using SQL, APIs, and files (5 years).
• Own applications end-to-end (5 years).
• 25% willingness to travel (required).

Preferred clearance

• Secret (Preferred).

Technologies

• Elasticsearch, Logstash, Kibana, Fleet
• Python, Bash, Kafka, CI/CD
• Streamlit, Docker, SQL, APIs

Nice to have

• Experience with Kafka, Python/Bash automation, CI/CD, or DevSecOps practices.
• Experience working with Ruby.
• Experience supporting AWS, Azure, GCP, Oracle Cloud, hybrid-cloud, or multi-cloud environments.
• Knowledge of cybersecurity operations, including SIEM, threat detection, incident response, and security monitoring.

Employment details

• Job type: Full-time
• Location: Hybrid remote in Leesburg, VA
• Salary: USD 120,000 - 150,000 per year
• Experience level: 5 years minimum
• Application question: desired salary requirement