Hybrid SIEM Engineer: Splunk to Elastic Transition

Skysoft Incorporated; Washington (District of Columbia, MD); Hybrid; USD 120,000 - 170,000; Full time

Job summary

Skysoft Incorporated in Washington, DC is seeking a seasoned SIEM Administrator/Engineer to manage Splunk Enterprise, support migration to Elastic, and enhance security monitoring across enterprise environments.

The candidate will troubleshoot production SIEM/logging infrastructure, onboard new data sources, and develop robust detections while collaborating with security engineers. A Public Trust eligibility and on-site presence 3 days/week are required.

Qualifications

• Bachelor's degree in a technical field or 4 years in lieu of degree
• 5+ years IT/cybersecurity experience
• Ability to obtain a Public Trust clearance (US citizenship/green card)
• 3+ years hands-on SIEM administration in enterprise environments
• Hands-on experience with Splunk Enterprise (SPL, ingestion, forwarders, dashboards)
• Experience onboarding and troubleshooting enterprise log sources through ingestion and search
• Working knowledge of SQL for data analysis and troubleshooting
• Experience with Elastic/Elasticsearch/Kibana or similar analytics tech
• Understanding of enterprise logging concepts (collection, normalization, retention)
• Strong Linux CLI skills and familiarity with Windows/Linux networks
• Familiarity with EDR, firewalls, IDS/IPS, identity systems, and vulnerability management
• Strong written/verbal communication and cross-team collaboration

Responsibilities

• Administer, maintain, monitor, and troubleshoot Splunk Enterprise and support Elastic/Elastic Security transition
• Migrate and validate data sources, searches, dashboards, reports, alerts during Splunk to Elastic move
• Configure and troubleshoot log ingestion pipelines (syslog, Windows Event, forwarders, Elastic agents)
• Onboard new data sources; ensure telemetry is collected, parsed, normalized, enriched, indexed, and searchable
• Develop and optimize SIEM searches, dashboards, and alerts using SPL and Elastic queries (KQL, ES|QL, EQL, DSL)
• Use SQL and other query languages to analyze data and support investigations
• Monitor SIEM health, performance, storage, ingestion, retention, capacity
• Collaborate with analysts to improve monitoring and detections
• Investigate problems, test hypotheses, identify root causes, implement solutions
• Automate where possible with scripting/APIs; maintain technical docs

Skills

SIEM administration

Splunk SPL

Elastic Stack

SQL

Linux

Education

Bachelor's degree in Cybersecurity/CS/Engineering

Tools

Splunk Enterprise

Elastic Stack

Kibana

SQL

Job description

Skysoft Incorporated in Washington, DC is seeking a seasoned SIEM Administrator/Engineer to manage Splunk Enterprise, support migration to Elastic, and enhance security monitoring across enterprise environments.

The candidate will troubleshoot production SIEM/logging infrastructure, onboard new data sources, and develop robust detections while collaborating with security engineers. A Public Trust eligibility and on-site presence 3 days/week are required.