Senior Elastic Stack Data Integration Lead

Amentum company; Huntsville (AL); On-site; USD 140,000 - 160,000; Full time

Benefits offered by this job

Health, dental, and vision insurance

401(k) matching

Educational reimbursement

Parental leave

Employee stock purchase plan

Job summary

Amentum is seeking a Senior Elastic Stack Data Integration Engineer to design, build, and optimize data ingestion pipelines for Elastic SIEM. You will focus on scalable Logstash architectures, ECS alignment, and high-availability pipelines across diverse data sources.

The role requires DoD 8570-M IAT II certification and an active DoW Secret clearance, with potential Top Secret eligibility. On-site at Schriever AFB or Redstone/ Huntsville, AL, up to 10% travel, day shift.

Qualifications

• Must have 4+ years general (full-time) work experience.
• Must have 3+ years directly related experience in log ingestion, data engineering, or SIEM pipeline development.
• Must have 2+ years in a management/leadership role.
• Strong background in Elastic Stack components (Elasticsearch, Kibana, Beats, Elastic Agent).
• Experience with data ingestion, processing, and enrichment techniques.
• Hands-on experience ingesting, processing, and normalizing diverse log types (Windows events, syslog, firewall logs, cloud telemetry).
• Proficiency with Linux administration and CLI-based operations.
• DoD 8570.01-M IAT Level II certification with CE.
• Active DoW Secret Security Clearance; ability to obtain DoW Top Secret clearance.

Responsibilities

• Architect, build, and maintain Logstash pipelines for diverse logs.
• Implement parsing, grok, JSON transformations, routing, and ECS mapping.
• Tune pipeline performance, resiliency, and scalability.
• Ensure data aligns to ECS or internal schemas.
• Implement data enrichment workflows (GeoIP, threat intel).
• Validate data integrity across ingestion flows.
• Maintain Logstash clusters, versioning, scaling, and HA.
• Manage integrations with Beats, Elastic Agent, Kafka, syslog, data collectors.
• Monitor throughput, latency, and errors; enable proactive alerting.
• Create pipeline diagrams, data flow maps, and runbooks.
• Establish enterprise parsing and ingestion standards.
• Support audits by documenting data handling flows.

Skills

Logstash

Elastic Stack

ECS mapping

Data ingestion

Troubleshooting

Documentation

Leadership

Cross-team collaboration

Education

DoD 8570.01-M IAT Level II certification

Elastic Stack certifications

Tools

Beats

Elastic Agent

Kafka

Syslog endpoints

Custom data collectors

Job description

Amentum is seeking a Senior Elastic Stack Data Integration Engineer to design, build, and optimize data ingestion pipelines for Elastic SIEM. You will focus on scalable Logstash architectures, ECS alignment, and high-availability pipelines across diverse data sources.

The role requires DoD 8570-M IAT II certification and an active DoW Secret clearance, with potential Top Secret eligibility. On-site at Schriever AFB or Redstone/ Huntsville, AL, up to 10% travel, day shift.