Elastic SIEM Engineer

ASRC Federal; Quantico (VA); Hybrid; USD 150,000 - 165,000; Full time

Benefits offered by this job

Health care

Dental

Vision

Life Insurance

401k

Education Assistance

Paid Time Off

Job summary

ASRC Federal is seeking an Elastic SIEM Engineer to maintain and enhance enterprise-scale Elastic Stack security solutions in support of the DCSA program. The role involves designing detection rules, data ingestion pipelines across cloud and on‑prem sources, and creating dashboards to empower SOC analysts.

Required five years of Elastic experience, active Secret clearance, and DoD IAM/IAT Level II certifications.

Qualifications

• Five years direct Elastic engineering/administration experience.
• Active Secret clearance REQUIRED, eligible for TS/SCI.
• Bachelor’s degree in information security or related field.
• DoD 8140/8570 IAM/IAT Level II certifications required (e.g., CCNA Security, CySA+, GICSP, GSEC, Security+, CISM, CISSP).
• Two+ years AWS experience (highly desired).

Responsibilities

• Maintain enterprise Elastic Stack security solutions for national security systems.
• Design and implement detection rules, correlation searches, and analytics pipelines (Elasticsearch, Logstash, Kibana).
• Tune detection logic to reduce false positives and automate security workflows.
• Collaborate with SOC, engineering teams, and government stakeholders to enhance detection capabilities.
• Ensure compliance with NIST 800-53 and RMF through documentation and leadership.

Skills

Elastic Stack

AWS

Python

Bash

Networking

Troubleshooting

Education

Bachelor's degree in information security or related field

DoD 8140/8570 IAM/IAT Level II certification requirements

Tools

Elasticsearch

Logstash

Kibana

Elastic Security

AWS Cloud

Job description

ASRC Federal is a leading government contractor furthering missions in space, public health and defense. As an Alaska Native owned corporation, our work helps secure an enduring future for our shareholders. Join our team and discover why we are a top veteran employer and Certified Great Place to Work.

ASRC Federal is actively hiring an Elastic SIEM Engineer in support of our Defense Counterintelligence Security Agency (DCSA) program based out of Hanover MD.

Remote flexibility available! Telework offered with a requirement to be onsite up to one day a week at Hanover, MD.

We invest in the lives of our employees, both in and out of the workplace, by providing competitive pay and benefit packages. This position is offering a pay range of $150,000.00 - $165,450.00 depending on experience, seniority, geographic locations, and factors permitted by law. Benefits offered may include health care, dental, vision, life insurance; 401k; education assistance; paid time off including Paid Time Off, holidays and any other paid leave required by law.

Job Description

As an Elastic SIEM Engineer, your primary duty is to maintain enterprise-scale Elastic Stack security solutions that safeguard our national security systems. You will design and implement advanced detection rules, correlation searches, and analytics pipelines using Elasticsearch, Logstash, Kibana, and Elastic Security to identify sophisticated threats and adversary activity. A key part of your role involves optimizing data ingestion pipelines from diverse sources including cloud platforms (AWS, Azure, GCP), network devices, endpoints, and security tools, ensuring high availability, performance, and scalability of the SIEM infrastructure. You will develop custom dashboards, visualizations, and threat hunting workbenches that empower SOC analysts to detect and respond to incidents effectively, while collaborating with security operations, engineering teams, and government stakeholders to enhance detection capabilities. Additionally, you will be responsible for tuning detection logic to reduce false positives, automating security workflows, integrating threat intelligence feeds, and ensuring all activities align with critical compliance standards like NIST 800-53 and RMF through comprehensive documentation and technical leadership.

Minimum Requirements

• At least five (5) Years – Direct Elastic engineering/administration experience
• Active Secret Clearance REQUIRED, eligible to be upgraded to TS/SCI
• Bachelor’s degree in information security or related field and/or equivalent combination of experience
• Certifications:
  • Must meet DoD 8140/8570 IAM or IAT Level II certifications’ requirements at the time of hire by having one of the following certifications. (CCNA Security, CySA +, GICSP, GSEC, Security+, SSSP, CAP, CASP CE, CISM, CISSP (or Associate) or GSLC
• Highly Desired:
  • Two (2) plus years of AWS experience

Basic Qualifications

• Experience in the support and maintenance of an Elastic infrastructure in a highly available configuration in an AWS Cloud environment
• Proven experience as an Elastic Engineer or similar role
• Strong understanding of Elastic architecture in a cloud environment, including data ingestion, indexing, search, and visualization
• Prior experience customizing and configuring Elastic environments according to client needs, including developing scripts and apps as necessary
• Proficiency in scripting languages such as Python or Bash for Elastic app and dashboard development
• Experience with data transformation and normalization to ensure compatibility with Elastic
• Troubleshoot Elastic indexers, search heads and forwarder problems
• Familiarity with networking principles and protocols
• Excellent problem-solving skills and the ability to work under pressure
• Strong communication and interpersonal skills, with the ability to explain technical concepts to non-technical stakeholders
• Experience analyzing log files from network traffic logs, firewall logs, IDS logs, DNS logs and ESS to ID possible security threats e.g., determine rogue systems, infected systems, unauthorized system changes and unauthorized hardware connections
• Work Environment and Physical Demands
• This is primarily a Telework position with a requirement to be onsite up to two days a week at Fort Meade, MD
• If alternate worksite is other than DCSA facilities or corporate office space, must have the reliable ability to communicate over voice (cell phone preferred) and stable, capable internet connection
• Must be able to work flexible hours to support critical security incidents, maintenance windows, and emergency response activities as needed

We invest in the lives of our employees, both in and out of the workplace, by providing competitive pay and benefits packages. Benefits offered may include health care, dental, vision, life insurance; 401(k); education assistance; paid time off including PTO, holidays, and any other paid leave required by law. The salary offered will depend on several factors including, but not limited to, relevant experience, skills, education, geographic location, internal equity, business needs, and other factors permitted by law. Posted pay ranges are a general guideline only and are not a guarantee of compensation or salary.

ASRC Federal and its Subsidiaries are Equal Opportunity employers. All qualified applicants will receive consideration for employment without regard to race, gender, color, age, sexual orientation, gender identification, national origin, religion, marital status, ancestry, citizenship, disability, protected veteran status, or any other factor prohibited by applicable law.