Remote Elastic SIEM Engineer - Threat Detection

Colonial Group; Quantico (VA); Hybride; USD 150 000 - 165 000; Plein temps

Avantages offerts par ce poste

Health insurance

Dental insurance

Vision insurance

Life insurance

401k

Education assistance

Paid time off

Résumé du poste

ASRC Federal is seeking an Elastic SIEM Engineer to support the DCSA program, combining on-site Fort Meade requirements with telework options.

You will design and maintain Elastic Stack security solutions, develop detections, dashboards, and threat-hunting workbenches, while coordinating with SOC analysts, engineering teams, and government stakeholders to enhance detection capabilities and compliance with NIST 800-53 and RMF.

Qualifications

• At least five years direct Elastic engineering/administration experience.
• Active Secret Clearance REQUIRED, eligible to be upgraded to TS/SCI.
• Bachelor’s degree in information security or related field (or equivalent).
• DoD IAM/IAT Level II certifications required at hire (e.g., CCNA Security, CySA+, GICSP, GSEC, Security+, SSSP, CAP, CASP CE, CISM, CISSP or Associate).
• Two plus years of AWS experience is highly desired.

Responsabilités

• Maintain enterprise-scale Elastic Stack security solutions to safeguard national security systems.
• Design and implement advanced detection rules, correlation searches, and analytics pipelines using Elasticsearch, Logstash, Kibana, and Elastic Security.
• Optimize data ingestion pipelines from cloud platforms (AWS, Azure, GCP), network devices, endpoints, and security tools.
• Develop custom dashboards, visualizations, and threat hunting workbenches for SOC analysts.
• Tune detection logic to reduce false positives, automate security workflows, and integrate threat intelligence feeds.
• Ensure compliance with NIST 800-53 and RMF through documentation and technical leadership.

Connaissances

Elastic engineering

AWS experience

Python scripting

Bash scripting

Threat hunting

Communication skills

Formation

Bachelor’s degree in information security or related field

Outils

Elasticsearch

Logstash

Kibana

Elastic Security

Description du poste

ASRC Federal is seeking an Elastic SIEM Engineer to support the DCSA program, combining on-site Fort Meade requirements with telework options.

You will design and maintain Elastic Stack security solutions, develop detections, dashboards, and threat-hunting workbenches, while coordinating with SOC analysts, engineering teams, and government stakeholders to enhance detection capabilities and compliance with NIST 800-53 and RMF.