Senior Elastic Stack SIEM Data Ingestion Architect

Amentum company; Colorado Springs (CO); On-site; USD 140,000 - 160,000; Full time

Benefits offered by this job

Health, dental, and vision insurance

Paid time off and holidays

401(k) matching

Educational reimbursement

Parental leave

Employee stock purchase plan

Tax-saving options

Disability and life insurance

Pet insurance

Job summary

Amentum seeks a Senior Elastic Stack Data Integration Engineer to design, build, and maintain data ingestion pipelines for Elastic SIEM. You will develop scalable Logstash architectures, ensure ECS alignment, and deliver high-fidelity data to Elasticsearch while adhering to DoD security requirements.

The role requires 4+ years in data engineering and 2+ years in leadership, DoD 8570 IAT II certification, DoD Secret clearance, Linux proficiency, and collaboration across teams to support audits

Qualifications

• 4+ years of general (full-time) work experience.
• 3+ years of directly related experience in log ingestion, data engineering, or SIEM pipeline development.
• 2+ years in a management or leadership role.
• Strong background in Elastic Stack components (Elasticsearch, Kibana, Beats, Elastic Agent).
• Active DoW Secret Security Clearance with ability to obtain Top Secret.

Responsibilities

• Architect, build, and maintain Logstash pipelines to ingest and transform logs from diverse systems.
• Implement parsing, grok patterns, JSON transformations, enrichment logic, and ECS mapping.
• Optimize pipeline performance, resiliency, and scalability with HA configurations.
• Ensure data aligns to ECS or internal schema requirements and maintain documentation.
• Manage integrations with Beats, Elastic Agent, Kafka, syslog endpoints, and custom data collectors.
• Monitor throughput, latency, and error rates; implement proactive alerting and troubleshooting.
• Collaborate with SIEM engineers and detection teams to align pipelines with analytics needs.
• Lead pipeline design decisions and mentor junior engineers.

Skills

Elastic Stack expertise

Logstash pipelines

Data ingestion

Troubleshooting

Documentation

Leadership

Tools

Elastic Stack (Elasticsearch, Kibana, Beats, Elastic Agent)

Logstash

Kafka

Beats/Elastic Agent

CLI/Linux

Job description

Amentum seeks a Senior Elastic Stack Data Integration Engineer to design, build, and maintain data ingestion pipelines for Elastic SIEM. You will develop scalable Logstash architectures, ensure ECS alignment, and deliver high-fidelity data to Elasticsearch while adhering to DoD security requirements.

The role requires 4+ years in data engineering and 2+ years in leadership, DoD 8570 IAT II certification, DoD Secret clearance, Linux proficiency, and collaboration across teams to support audits