Elastic SIEM Engineer & SME – TS/SCI – Onsite San Antonio

Maximus; San Antonio (TX); On-site; USD 130,000 - 180,000; Full time

Job summary

Maximus in San Antonio, TX is seeking a Cybersecurity Engineer – Elastic SIEM SME with an active TS/SCI clearance to support DoD cyberspace operations. The role focuses on Elastic SIEM architecture, threat detection, and incident response across multiple networks.

On-site work required, with Agile/SAFe delivery and collaboration with government teams. You will mentor junior engineers, develop runbooks, and ensure robust security operations.

Qualifications

• Active TS/SCI security clearance.
• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field.
• 10+ years hands-on cybersecurity engineering experience.
• Advanced proficiency in Elastic SIEM architecture and complex troubleshooting.
• Hands-on experience with Elastic Stack in an operational SIEM environment.
• Experience with threat detection, alert triage, and cyber incident investigation.

Responsibilities

• Serve as Elastic SIEM SME and advise the team and customer.
• Architect, operate, and sustain Elastic SIEM across NIPRNet/SIPRNet/JWICS.
• Monitor SIEM health, capacity planning, and outages per SLAs.
• Design and review detection rules, alerts, dashboards, and visualizations.
• Ingest and validate logs from endpoint, network, cloud, and apps.
• Collaborate with cyber operators and analysts on incident workflows.
• Improve SIEM coverage and data quality in coordination with Government PMO.
• Support CSSP activities including continuous monitoring and analysis.
• Create documentation: runbooks, SOPs, and knowledge base articles.
• Mentor engineers and establish technical standards; participate in PI planning.

Skills

Elastic SIEM

Elastic Stack

DoD/DCO experience

Cybersecurity engineering

TS/SCI clearance

Agile/SAFe

Threat detection

Education

Bachelor's degree in Cybersecurity/CS/IT

Tools

Elasticsearch

Kibana

Logstash

Beats/Elastic Agent

AWS GovCloud

Kubernetes

Job description

Maximus in San Antonio, TX is seeking a Cybersecurity Engineer – Elastic SIEM SME with an active TS/SCI clearance to support DoD cyberspace operations. The role focuses on Elastic SIEM architecture, threat detection, and incident response across multiple networks.

On-site work required, with Agile/SAFe delivery and collaboration with government teams. You will mentor junior engineers, develop runbooks, and ensure robust security operations.