Elastic SIEM Architect – TS/SCI Engineer

Maximus; San Antonio (TX); On-site; USD 190,000 - 220,000; Full time

Job summary

Maximus seeks a Cybersecurity Engineer as an Elastic SIEM SME to lead architecture, operation, and sustainment of the Elastic SIEM platform across NIPRNet, SIPRNet, and JWICS. The role requires TS/SCI clearance and on-site work in San Antonio, TX.

The candidate will guide detections, dashboards, and data ingestion while collaborating with cyber operators and analysts to support threat detection and incident investigation. Strong DoD/IC experience is essential.

Qualifications

• Active TS/SCI clearance required.
• 10+ years hands-on cybersecurity engineering experience.
• Experience with Elastic Stack in an operational SIEM.
• Experience across NIPR/SIPR/JWICS networks.

Responsibilities

• Serve as the Elastic SIEM SME and advise the team and customer.
• Architect, operate, and sustain Elastic SIEM across environments (NIPRNet, SIPRNet, JWICS).
• Monitor SIEM health, capacity, and outages per SLAs.
• Design detection rules, alerts, dashboards, and visualizations in Elastic.
• Ingest, normalize, and validate logs from diverse sources.
• Collaborate with operators and analysts on threat detection workflows.
• Lead improvements in SIEM coverage and data quality with Government PMO.
• Support CSSP activities including monitoring and security event analysis.
• Create and maintain runbooks, SOPs, and knowledge base articles.
• Mentor senior/journeyman engineers and set technical standards.
• Participate in Agile/SAFe PI planning and sprint execution.
• Adhere to DoD/IC/USAF cybersecurity standards.

Skills

Elastic SIEM

Threat detection

Architectural guidance

Mentor engineers

Education

Bachelor's degree

Tools

Elasticsearch

Kibana

Logstash

Beats/Elastic Agent

Cortex XSOAR

Kubernetes

AWS GovCloud

Job description

Maximus seeks a Cybersecurity Engineer as an Elastic SIEM SME to lead architecture, operation, and sustainment of the Elastic SIEM platform across NIPRNet, SIPRNet, and JWICS. The role requires TS/SCI clearance and on-site work in San Antonio, TX.

The candidate will guide detections, dashboards, and data ingestion while collaborating with cyber operators and analysts to support threat detection and incident investigation. Strong DoD/IC experience is essential.