Onsite Elastic Stack Engineer: High-Volume Ingestion & ECS

Piper Companies; Schriever Space Force Base (CO); On-site; USD 120,000 - 180,000; Full time

Benefits offered by this job

Medical benefits

401K

PTO

Holidays

Job summary

Zachary Piper Solutions seeks an Elastic Engineer to support a mission-critical federal program at Schriever Space Force Base. The role is on-site and focuses on designing, implementing, and maintaining large-scale log ingestion architectures using the Elastic Stack.

Ideal candidates will have deep expertise in Logstash, ECS normalization, and high-volume ingestion across restricted environments, with experience in air-gapped deployments and security-focused logging pipelines.

Qualifications

• 3+ years hands-on Elastic Stack experience.
• Advanced Logstash pipeline engineering expertise.
• Strong knowledge of ECS and data normalization.
• Linux administration experience.
• Proven experience troubleshooting high-volume ingestion and pipeline performance.

Responsibilities

• Design and deploy ingestion pipelines for security telemetry, network, cloud, and log sources.
• Normalize data into ECS formats.
• Implement parsing using Grok, Dissect, KV, JSON decoding, Translate filters.
• Design multi-pipeline Logstash architectures and routing.
• Tune Logstash JVM performance and troubleshoot bottlenecks.
• Deploy Elastic Agents via Fleet Server and centralized policy management.
• Support air-gapped artifacts and repositories.
• Ensure ingestion resiliency, redundancy, and failover.

Skills

Elastic Stack

Logstash pipeline engineering

Linux administration

High-volume ingestion

Grok/Dissect/Translate filters

Tools

Elastic Stack

Logstash

Kibana

Elastic Common Schema (ECS)

Fleet Server

Ansible

Python

Bash

Job description

Zachary Piper Solutions seeks an Elastic Engineer to support a mission-critical federal program at Schriever Space Force Base. The role is on-site and focuses on designing, implementing, and maintaining large-scale log ingestion architectures using the Elastic Stack.

Ideal candidates will have deep expertise in Logstash, ECS normalization, and high-volume ingestion across restricted environments, with experience in air-gapped deployments and security-focused logging pipelines.