Elastic SIEM Engineer (TS/SCI) – Onsite, San Antonio

Maximus

San Antonio (TX)

On-site

USD 130,000 - 185,000

Full time

14 days+

Application generator

Turn this role into an interview — a resume and cover letter built around what this employer wants.

Get past ATS filters

Job summary

Maximus seeks a Cybersecurity Engineer – Elastic SIEM (Journeyman) to join our on-site team in San Antonio, TX. You will administer Elastic SIEM across secured DoD networks and support threat detection and incident response.

Requirements include active TS/SCI clearance, a Bachelor's degree, 5+ years in cybersecurity, and hands-on Elastic Stack experience. You will work in Agile environments, maintain runbooks, and collaborate with CSP/CSSP teams to strengthen monitoring.

Qualifications

Active TS/SCI clearance required.
Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field (or equivalent).
5+ years hands‑on cybersecurity engineering experience.
Elastic Stack experience in operational SIEM environments.
Experience with threat detection, alert triage, and incident investigation.
Familiarity with DCO concepts, CSSP operations, and defensive cyber frameworks.
Experience across NIPRNet, SIPRNet, or JWICS networks.
DoD 8140 requirements compliance; related certifications preferred.

Responsibilities

Administer, operate, and sustain the Elastic SIEM platform across NIPRNet, SIPRNet, and JWICS environments.
Monitor SIEM health, capacity planning, and resolve outages per SLAs.
Develop, tune, and maintain detection rules, alerts, dashboards, and visualizations.
Ingest, normalize, and validate logs from endpoint, network, cloud, and application telemetry.
Collaborate with cyber operators and analysts on detection and incident workflows.
Create and maintain runbooks, SOPs, and knowledge base articles.