Senior Elastic Stack Data Integration Engineer IRES - SSFB/HSV

PAE Government Services Inc.; Colorado; On-site; USD 140,000 - 160,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

401(k) matching

Paid time off

Educational reimbursement

Parental leave

Employee stock purchase plan

Tax-saving options

Disability and life insurance

Pet insurance

Job summary

PAE Government Services Inc. seeks a Senior Elastic Stack Data Integration Engineer to design, build, and maintain data ingestion pipelines supporting Elastic SIEM at DoD environments.

You will architect Logstash pipelines ingesting logs from diverse sources and ensure ECS alignment, with a focus on performance, reliability, and scalable architectures. This role requires 4+ years in data ingestion or SIEM pipeline development, DoD clearance readiness, strong Linux skills, and experience with

Qualifications

• Must have 4 or more years of general (full-time) work experience.
• Must have 3 or more years of directly related experience in log ingestion or SIEM pipeline development.
• Must have 2 or more years in a management or leadership role.
• Strong background in Elastic Stack components (Elasticsearch, Kibana, Beats, Elastic Agent).
• Hands-on experience ingesting and normalizing diverse log types (Windows events, syslog, firewall logs, cloud telemetry).
• Proficient with Linux administration, system-level debugging, and CLI operations.
• Active DoD 8570.01-M IAT LevelII certification with CE and DoD Secret clearance.
• Ability to obtain and maintain a DoD Top Secret clearance.

Responsibilities

• Architect, build, and maintain Logstash pipelines to ingest and transform logs from diverse systems.
• Implement parsing, grok patterns, JSON transformations, routing, and ECS mapping.
• Optimize pipeline performance, resiliency, and scalability with features like persistent queues.
• Ensure ingested data aligns to ECS or internal schema requirements.
• Develop data enrichment workflows (GeoIP, threat intel lookups, metadata injection).
• Validate data completeness, integrity, and fidelity across ingestion flows.
• Maintain and optimize Logstash clusters, including version management and high availability.
• Manage integrations with Beats, Elastic Agent, Kafka, syslog endpoints, and custom collectors.
• Monitor throughput, latency, and error rates; implement proactive alerting and troubleshooting.
• Create technical documentation, runbooks, and data-flow diagrams.

Skills

Elastic Stack

Logstash pipelines

Data ingestion

ECS alignment

Linux administration

Troubleshooting

Documentation

Collaboration

Pipeline scalability

Tools

Beats

Elastic Agent

Kafka

GitOps

Job description

Position Title: Senior Elastic Stack Data Integration Engineer

Location: Schriever Space Force Base, Colorado Springs, CO or Redstone Arsenal, Huntsville, AL

Relocation Assistance: None available at this time

Remote/Telework: NO - Not available for this position

Clearance Type: DoW Secret

Shift: Day shift

Travel Required: Up to 10% of the time

Description of Duties: The Senior Elastic Stack Data Integration Engineer will serve as the primary technical authority for designing, building, and maintaining data ingestion pipelines supporting Elastic SIEM. This role focuses on creating scalable, resilient Logstash architectures; developing advanced pipeline logic; normalizing, enriching, and transforming security telemetry; and ensuring reliable delivery of high-fidelity data to Elasticsearch.

Key Responsibilities

• Architect, build, and maintain Logstash pipelines to ingest and transform logs from diverse systems, including network devices, servers, cloud services, and security platforms.
• Implement parsing, grok patterns, JSON transformations, conditional routing, enrichment logic, and ECS mapping.
• Optimize pipeline performance, resiliency, and scalability (e.g., persistent queues, pipeline workers, memory tuning, load balancing).
• Ensure all ingested data aligns to ECS (Elastic Common Schema) or internal schema requirements.
• Implement data enrichment workflows (GeoIP, threat intel lookups, metadata injection).
• Validate data completeness, integrity, and fidelity across ingestion flows.
• Maintain and optimize Logstash clusters, including version management, scaling, tuning, and high-availability configurations.
• Manage integrations with Beats, Elastic Agent, Kafka, syslog endpoints, and custom data collectors.
• Monitor ingestion throughput, latency, and error rates; implement proactive alerting and troubleshooting processes.
• Create and maintain technical documentation, including pipeline diagrams, data flow maps, runbooks, and schema references.
• Establish enterprise standards for parsing, enrichment, normalization, and ingestion patterns.
• Support internal and external audits by documenting data handling flows and pipeline logic.
• Work closely with SIEM integration engineers to align pipelines with customer environments and logging requirements.
• Partner with detection engineering teams to ensure data supports analytic coverage and rule development.
• Collaborate with infrastructure and platform operations for deployment, scaling, and reliability engineering.

The successful candidate will have

• Deep command of Logstash architecture, patterns, and performance optimization.
• Mastery of parsing, enrichment, normalization, and ECS alignment.
• Strong understanding of network protocols, logging patterns, and telemetry generation from enterprise systems.
• Advanced troubleshooting skills across data ingestion, pipeline logic, and Elastic Stack processing layers.
• Capability to design scalable, HA ingestion workflows with clear operational boundaries.
• Ability to conduct data modeling, schema design, and transformation mapping.
• Effective at interfacing with multiple teams, gathering requirements, and aligning pipeline designs with SIEM analytics needs.
• Focused on reliability, maintainability, and observability across all pipeline components.
• Strong attention to detail and a disciplined approach to documentation, versioning, and configuration management.
• Demonstrated ability to work independently, drive pipeline architecture decisions, and mentor junior engineers.
• Strong documentation, workflow diagramming, and communication skills.

Basic Requirements

• Must have 4, or more, years of general (full-time) work experience. May be reduced with completion of advanced education.
• Must have 3, or more, years of directly related experience in log ingestion, data engineering, or SIEM pipeline development.
• Must have 2, or more, years of experience working in a management or leadership role.
• Must have a strong background in Elastic Stack components (Elasticsearch, Kibana, Beats, Elastic Agent).
• Must have experience with data ingestion, processing, and enrichment techniques.
• Must have hands-on experience ingesting, processing, and normalizing diverse log types (Windows events, syslog, firewall logs, cloud telemetry, security tooling).
• Must be proficient with Linux administration, system-level debugging, and CLI-based operations.
• Must have a DoD 8570.01-M IAT LevelII certification with Continuing Education (CE)– (CCNA-Security, CySA+, GICSP, GSEC, Security+CE, CND, SSCP).
• Must have an active DoW Secret Security Clearance.
• Must be able to obtain, and maintain, a DoW Top Secret Security Clearance.

Desired Requirements

• Be an Elastic Certified Engineer or have relevant Elastic Stack certifications.
• Have strong experience integrating Kafka, Redis, or other message bus technologies into ingestion workflows.
• Have scripting proficiency in Python, Bash, or PowerShell for automation and data validation.
• Have experience designing geo‑distributed or multi‑cluster ingestion architectures.
• Have knowledge of threat intelligence ingestion, correlation data enrichment, and advanced ECS mapping.
• Have experience with CI/CD pipelines, GitOps workflows, or Infrastructure-as-Code (Terraform, Ansible).
• Be familiar with data quality assurance frameworks and pipeline testing methodologies.
• Have knowledge of cloud‑native logging architectures (AWS Firehose, Azure Event Hub, GCPLogging).

Compensation Details

$140,000 – $160,000

The compensation range or hourly rate listed for this position is provided as a good‑faith estimate of what the company intends to offer for this role at the time this posting was issued. Actual compensation may vary based on factors such as job responsibilities, education, experience, skills, internal equity, market data, applicable collective bargaining agreements, and relevant laws.

Benefits Overview

• Health, dental, and vision insurance
• Paid time off and holidays
• Retirement benefits (including401(k)matching)
• Educational reimbursement
• Parental leave
• Employee stock purchase plan
• Tax‑saving options
• Disability and life insurance
• Pet insurance

Note: Benefits may vary based on employment type, location, and applicable agreements. Positions governed by a Collective Bargaining Agreement (CBA), the McNamara‑O’Hara Service Contract Act (SCA), or other employment contracts may include different provisions/benefits.

Original Posting

Original Posting: 10/05/2026 - 10/13/2026 Amentum anticipates this job requisition will remain open for at least three days, with a closing date no earlier than three days after the original posting. This timeline may change based on business needs.

Equal Opportunity Employer Statement

Amentum is proud to be an Equal Opportunity Employer. Our hiring practices provide equal opportunity for employment without regard to race, sex, sexual orientation, pregnancy (including pregnancy, childbirth, breastfeeding, or medical conditions related to pregnancy, childbirth, or breastfeeding), age, ancestry, UnitedStatesmilitary or veteran status, color, religion, creed, marital or domestic partner status, medical condition, genetic information, national origin, citizenship status, low‑income status, or mental or physical disability so long as the essential functions of the job can be performed with or without reasonable accommodation, or any other protected category under federal, state, or local law. Learn more about your rights under Federal laws and supplemental language at Labor Laws Posters.

Thank you for continued interest in employment with Amentum.

For more than 100 years, Amentum has tackled the world’s toughest challenges to deliver agile and steadfast solutions to the U.S. government and its allies. With more than 50,000 employees on all seven continents and in more than 60 countries, Amentum delivers a broad range of operational support services to meet the critical needs of our clients.

Our headquarters are in Chantilly, VA. Find us online at https://www.amentum.com/.

If you need a reasonable accommodation for any part of the employment process, please complete our Accommodation Request. Requests for accommodation will be considered on a case‑by‑case basis. If you need assistance, please reach out to [e-mail].