Elastic SIEM SME — Cyber Defense Architect (TS/SCI)

Maximus; San Antonio (TX); On-site; USD 150,000 - 190,000; Full time

Job summary

Maximus seeks a Cybersecurity Engineer – Elastic SIEM SME for on-site duties in San Antonio, TX. The role requires an active TS/SCI clearance and a decade of hands-on security engineering expertise in Elastic SIEM across DoD environments.

You will guide Elastic Stack architecture, notifications, and dashboards, while ingesting diverse data sources and supporting threat detection, incident response, and outcomes aligned with SLAs. Strong leadership and DoD compliance are key.

Qualifications

• Active TS/SCI security clearance.
• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field.
• 10+ years of hands-on cybersecurity engineering experience.
• Advanced proficiency in Elastic SIEM architecture and operations.
• Hands-on experience with Elastic Stack in operational SIEM.
• Experience with threat detection, alert triage, and cyber incident investigation.
• Familiarity with DCO concepts, CSSP operations, and defensive cyber frameworks.
• Experience across NIPR, SIPR, or JWICS networks.

Responsibilities

• Serve as Elastic SIEM SME; provide technical direction for architecture and operations.
• Monitor SIEM health, capacity planning, and complex outage resolution.
• Design and review detection rules, alerts, dashboards, and visualizations in Elastic.
• Ingest and normalize logs from endpoint, network, cloud, and apps.
• Collaborate with cyber operators and analysts on threat detection and investigations.
• Lead SIEM improvements and coordinate with Government PMO.
• Support CSSP activities including continuous monitoring and event analysis.
• Create runbooks, SOPs, and knowledge base articles.

Skills

Elastic SIEM

Threat detection

Senior engineering leadership

Cross-domain security

Education

Bachelors in Cybersecurity/CS/IT

Tools

Elastic Stack

Elasticsearch

Kibana

Logstash

Beats/Elastic Agent

Kubernetes

Job description

Maximus seeks a Cybersecurity Engineer – Elastic SIEM SME for on-site duties in San Antonio, TX. The role requires an active TS/SCI clearance and a decade of hands-on security engineering expertise in Elastic SIEM across DoD environments.

You will guide Elastic Stack architecture, notifications, and dashboards, while ingesting diverse data sources and supporting threat detection, incident response, and outcomes aligned with SLAs. Strong leadership and DoD compliance are key.