Elasticsearch Cyber Data Engineer (SIEM)

Socket.dev; Springfield (VA); On-site; USD 82,000 - 172,000; Full time

Benefits offered by this job

Flexible time off

Robust learning resources

Job summary

CACI is seeking a Cyber Data Analysis Engineer (Elasticsearch) to design, build, and maintain data collection and SIEM environments supporting government cybersecurity missions. You’ll work with on-prem and cloud systems to collect log data from multiple agencies, ensuring secure, retrievable storage and timely insights.

The role requires TS/SCI with polygraph, strong Unix/Linux and SIEM expertise, and the ability to collaborate across teams.

Qualifications

• Active TS/SCI clearance with polygraph or ability to pass
• Bachelor’s degree in CS/IT or related field with 6+ years of experience or equivalent
• DOD 8570 IAT Level II certification
• Ability to obtain CSSP Infrastructure Support Certification within 90 days
• 3+ years Unix/Linux Server Administration
• 2+ years Windows Server Administration
• 2+ years SIEM administration (Elasticsearch, Splunk, Sentinel, ArcSight, etc.)
• Strong written and oral communication skills
• Good listening and comprehension

Responsibilities

• Help customers send log data through enterprise networks to a destination
• Design, build, and maintain log data pipelines (Cribl, ArcSight, Kafka, AWS, Linux/Windows)
• Manage log data environments using Elasticsearch or Sentinel
• Identify resources to optimize Linux systems or hosted products
• Troubleshoot data flow from SIEM data collection to storage or SIEM
• Troubleshoot display or storage issues within SIEM
• Perform root cause analysis for complex issues
• Design indicators of system health for maximum uptime
• Maintain appropriate versions per agency policies
• Develop or improve processes using scripts, Ansible, or AWS
• Document tasks, changes, and statuses
• Provide team training on tasks and products
• Interact with customers during all project phases
• Be responsive to customer needs
• On-call duties occasionally (nights/weekends)

Skills

Unix/Linux Server Administration

Windows Server Administration

SIEM administration

Communication skills

Education

Bachelor's Degree in CS/IT or related field

Tools

Elasticsearch

ArcSight

Kafka

Cribl

AWS

Job description

CACI is seeking a Cyber Data Analysis Engineer (Elasticsearch) to design, build, and maintain data collection and SIEM environments supporting government cybersecurity missions. You’ll work with on-prem and cloud systems to collect log data from multiple agencies, ensuring secure, retrievable storage and timely insights.

The role requires TS/SCI with polygraph, strong Unix/Linux and SIEM expertise, and the ability to collaborate across teams.