Onsite TS/SCI Elastic SIEM Engineer – San Antonio

Maximus; San Antonio (TX); On-site; USD 120,000 - 140,000; Full time

Job summary

Maximus is seeking a Cybersecurity Engineer - Elastic SIEM (Journeyman) for an on-site role in San Antonio, TX. Active TS/SCI clearance is required.

The seniority is implied as Journeyman with responsibilities spanning Elastic SIEM administration and threat detection workflow support. The candidate will manage Elastic Stack components across multiple DoD networks, contribute to detection rule tuning, and participate in Agile planning.

Qualifications

• Active TS/SCI clearance required.
• 5+ years hands-on cybersecurity engineering experience.
• Bachelor's degree in Cybersecurity, CS, IT, or related field.
• Ability to independently administer and troubleshoot Elastic SIEM operations.
• Experience with Elastic Stack (Elasticsearch, Kibana, Logstash, Beats/Elastic Agent) in an operational SIEM environment.
• Experience supporting threat detection, alert triage, and cyber incident investigation.
• Familiarity with DCO concepts, CSSP operations, and defensive cyber frameworks.
• Experience working across NIPRNet, SIPRNet, or JWICS.
• Meet DoD 8140 requirements; DCWF 521, Cyber Defense Infrastructure Support Specialist, Intermediate Proficiency.

Responsibilities

• Independently perform standard SIEM engineering tasks with limited supervision; escalate complex issues.
• Administer, operate, and sustain Elastic SIEM across NIPRNet, SIPRNet, and JWICS.
• Monitor SIEM health, plan capacity, and resolve outages per SLAs.
• Develop, tune, and maintain detection rules, alerts, dashboards, and visualizations in Elastic.
• Ingest, normalize, and validate log data from endpoints, network, cloud, and apps.
• Collaborate with cyber operators and analysts for threat detection and incident workflows.
• Identify opportunities to improve SIEM coverage and data quality; coordinate improvements with Government PMO.
• Support CSSP activities including continuous monitoring and security event analysis.
• Create and maintain technical documentation: runbooks, SOPs, knowledge base.
• Participate in Agile/SAFe PI planning and sprint execution for platform delivery.
• Adhere to Air Force cybersecurity standards across enclaves.

Skills

Security clearance

DoD 8140

Threat detection

Incident investigation

Elastic SIEM

Elastic Stack

SLA adherence

Cross-network ops

Education

Bachelor's degree in Cybersecurity/CS/IT

Tools

Elastic Stack

Kibana

Logstash

Beats/Agent

Kubernetes

AWS GovCloud

Job description

Maximus is seeking a Cybersecurity Engineer - Elastic SIEM (Journeyman) for an on-site role in San Antonio, TX. Active TS/SCI clearance is required.

The seniority is implied as Journeyman with responsibilities spanning Elastic SIEM administration and threat detection workflow support. The candidate will manage Elastic Stack components across multiple DoD networks, contribute to detection rule tuning, and participate in Agile planning.