Elastic SIEM Security Engineer - TS/SCI Onsite San Antonio

Maximus, Inc.; San Antonio (TX); On-site; USD 120,000 - 140,000; Full time

Job summary

Maximus seeks a Cybersecurity Engineer – Elastic SIEM (Journeyman) to join our onsite team in San Antonio, TX. You will administer Elastic Stack across multiple networks, develop detection content, and support threat detection and incident response with DoD guidelines.

Required TS/SCI clearance, a bachelor’s in a related field, and at least 5 years of hands‑on cybersecurity engineering experience. The role involves Agile planning and documented procedures, with strong emphasis on operational

Qualifications

• Active TS/SCI security clearance.
• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or related field or equivalent experience.
• 5 years of hands-on cybersecurity engineering experience.
• Experience with Elastic Stack in an operational SIEM environment.
• Experience supporting threat detection, alert triage, and cyber incident investigation.

Responsibilities

• Independently perform standard SIEM engineering tasks with limited supervision and escalate complex issues.
• Administer, operate, and sustain Elastic SIEM across NIPRNet, SIPRNet, and JWICS.
• Monitor SIEM health, capacity plan, and resolve outages per SLAs.
• Develop, tune, and maintain detection rules, alerts, dashboards, and visualizations in Elastic.
• Ingest, normalize, and validate log data from endpoint, network, cloud, and application telemetry.
• Collaborate with cyber operators and analysts on threat detection and incident workflows.
• Identify opportunities to improve SIEM coverage and data quality; implement with Government PMO.
• Support CSSP activities including continuous monitoring and security event analysis.
• Create and maintain runbooks, SOPs, and knowledge base articles.
• Participate in Agile/SAFe PI planning and sprint delivery.

Skills

Elastic SIEM

SIEM engineering

Threat detection

Incident investigation

AWS GovCloud

Scripting (Python)

KQL/EQL

Education

Bachelor’s degree in Cybersecurity/CS/IT

Tools

Elastic Stack

Kibana

Logstash

Beats/Elastic Agent

SIEM integrations

Palo Alto Cortex XSOAR

Job description

Maximus seeks a Cybersecurity Engineer – Elastic SIEM (Journeyman) to join our onsite team in San Antonio, TX. You will administer Elastic Stack across multiple networks, develop detection content, and support threat detection and incident response with DoD guidelines.

Required TS/SCI clearance, a bachelor’s in a related field, and at least 5 years of hands‑on cybersecurity engineering experience. The role involves Agile planning and documented procedures, with strong emphasis on operational