Senior Elastic Stack Data Ingestion Architect

Amentum; Colorado Springs (CO); On-site; USD 140,000 - 160,000; Full time

Benefits offered by this job

Health, dental, and vision insurance

401(k) matching

Educational reimbursement

Parental leave

Employee stock purchase plan

Tax-saving options

Disability and life insurance

Pet insurance

Job summary

Amentum is seeking a Senior Elastic Stack Data Integration Engineer to design, build, and maintain data ingestion pipelines supporting Elastic SIEM at Schriever Space Force Base or Redstone Arsenal. You will architect Logstash pipelines, ensure ECS alignment, and deliver high-fidelity security telemetry across diverse sources.

The role requires DoD 8570 Level II certification or equivalent, DoW Secret clearance, and strong Linux, Kafka, and CI/CD experience.

Qualifications

• 4+ years of general (full-time) work experience.
• 3+ years of directly related experience in log ingestion, data engineering, or SIEM pipeline development.
• 2+ years in a management or leadership role.
• Strong background in Elastic Stack components (Elasticsearch, Kibana, Beats, Elastic Agent).
• Hands-on experience ingesting, processing, and normalizing diverse log types (Windows events, syslog, firewall logs, cloud telemetry).
• Proficient with Linux administration, system debugging, and CLI operations.
• DoD 8570.01-M IAT Level II certification with Continuing Education.
• Active DoW Secret Security Clearance and ability to obtain Top Secret.

Responsibilities

• Architect, build, and maintain Logstash pipelines to ingest and transform logs from diverse systems.
• Implement parsing, grok patterns, JSON transformations, conditional routing, enrichment logic, and ECS mapping.
• Optimize pipeline performance, resiliency, and scalability with best practices.
• Ensure all ingested data aligns to ECS or internal schema requirements.
• Implement data enrichment workflows and metadata injection.
• Validate data completeness, integrity, and fidelity across ingestion flows.
• Maintain and optimize Logstash clusters, including version management and HA configurations.
• Manage integrations with Beats, Elastic Agent, Kafka, syslog endpoints, and custom data collectors.
• Monitor ingestion throughput, latency, and error rates; implement proactive alerting.
• Create and maintain technical documentation and runbooks.
• Collaborate with SIEM engineers and detection teams to support analytics and rules.

Education

DoD 8570.01-M IAT Level II certification with Continuing Education

Tools

Logstash

Elastic Stack

Kafka

Elastic Agent

Beats

Syslog

Job description

Amentum is seeking a Senior Elastic Stack Data Integration Engineer to design, build, and maintain data ingestion pipelines supporting Elastic SIEM at Schriever Space Force Base or Redstone Arsenal. You will architect Logstash pipelines, ensure ECS alignment, and deliver high-fidelity security telemetry across diverse sources.

The role requires DoD 8570 Level II certification or equivalent, DoW Secret clearance, and strong Linux, Kafka, and CI/CD experience.