Elastic Security Engineer

TekStream Solutions; Lincoln (MA); On-site; USD 140,000 - 180,000; Full time

Job summary

TekStream Solutions is seeking a Senior Elastic/SIEM Cybersecurity Engineer to lead Elastic Stack administration and SIEM operations onsite at Hanscom AFB, MA. You will manage Elasticsearch, Kibana, Logstash, Beats, and Fleet, while developing detection rules and dashboards for secure operations.

The role requires 5+ years of Elastic Stack experience, strong cloud and coding skills, and U.S. citizenship with eligibility for Secret clearance. Onsite work 5 days a week is required.

Qualifications

• 5+ years of Elastic Stack administration
• Strong experience with Elasticsearch, Kibana, Logstash, Beats, or Elastic Fleet
• Experience with SIEM, SOC operations, or defensive cybersecurity
• Government/federal cybersecurity environments experience
• Cloud experience, preferably AWS
• Experience with Terraform and GitLab

Responsibilities

• Design, implement, integrate, and maintain systems supporting complex cybersecurity operations
• Administer and optimize the Elastic Stack components
• Manage Elasticsearch index lifecycle policies, templates, data streams
• Build Kibana dashboards, visualizations, and Lens-based analytics
• Develop Elastic Security detection rules, alerts, and case management workflows
• Design log ingestion pipelines including parsing, enrichment, and normalization
• Map heterogeneous log sources to ECS
• Optimize security log collection from AWS, endpoints, network devices, and identity systems
• Support cybersecurity operations in SOC/SIEM/defensive cybersecurity environments
• Apply automation and Infrastructure as Code using Terraform
• Work with GitLab and modern CI/CD practices
• Troubleshoot complex technical issues and provide innovative cybersecurity solutions
• Onsite 5 days/week at Hanscom AFB, MA

Skills

Elastic Stack Admin

Elasticsearch

Kibana

Logstash

Beats

Elastic Fleet

Terraform

GitLab

AWS

SIEM

Tools

Terraform

GitLab

AWS

Elastic Stack

Elasticsearch

Kibana

Logstash

Beats

Elastic Fleet

ECS

Lens

Job description

Hiring: Senior Elastic / SIEM Cybersecurity Engineer

Clearance: U.S. Citizen; must be eligible for Secret clearance. Active clearance is not required to start.

About the Role

We are seeking a Senior Elastic/SIEM Cybersecurity Engineer to serve as the primary Elastic resource on the team. This is an excellent opportunity for someone who can independently manage complex Elastic environments while collaborating effectively with a broader cybersecurity team.

• Design, implement, integrate, and maintain systems and tools supporting complex cybersecurity operations.
• Administer and optimize the Elastic Stack, including Elasticsearch, Kibana, Logstash, Beats, and/or Fleet.
• Manage Elasticsearch index lifecycle policies, templates, and data streams at scale.
• Build Kibana dashboards, visualizations, and Lens-based analytics for security operations.
• Develop and manage Elastic Security detection rules, alerts, and case management workflows.
• Design log ingestion pipelines including parsing, enrichment, and normalization.
• Map heterogeneous log sources to Elastic Common Schema (ECS).
• Optimize security log collection from AWS, endpoints, network devices, and identity systems.
• Support cybersecurity operations in SOC/SIEM/defensive cyber environments.
• Apply automation and Infrastructure as Code using Terraform.
• Work with GitLab and modern CI/CD practices.
• Troubleshoot complex technical issues and provide innovative cybersecurity solutions.
• 5+ years of Elastic Stack administration OR strong Linux + SIEM + coding experience that can substitute for direct Elastic experience.
• Strong experience with Elasticsearch, Kibana, Logstash, Beats, or Elastic Fleet.
• Experience with SIEM, SOC operations, or defensive cybersecurity.
• Experience in government/federal cybersecurity environments.
• Cloud experience, preferably AWS.
• Experience with Terraform and GitLab.
• U.S. Citizen eligible to obtain a Secret clearance.
• Ability to work onsite 5 days/week in Hanscom AFB, MA.

Nice to Have

• DoD cybersecurity experience.
• Elastic ML / UEBA and anomaly detection.
• ES|QL or EQL.
• Elastic Agent Fleet management at scale.
• Python, scikit-learn, or PyTorch.
• Elastic AI Assistant / LLM integration.
• Kubernetes experience or certification.
• Experience with IL4/IL5/IL6 environments.