Senior Security Analyst - Elastic SIEM & Threat Hunting

ecsfederal; Illinois; On-site; USD 110,000 - 150,000; Full time

Job summary

ECS is seeking a Senior Security Analyst to support at Scott AFB, IL. You will investigate alerts, hunt threats, and operationalize detection across network, cloud, and endpoint telemetry.

You will leverage Elastic SIEM, Kibana, and log pipelines to create detections, dashboards, and automation. Travel for short engagements and direct customer interaction are expected. A Secret clearance and US Passport are required.

Qualifications

• 2+ years of cybersecurity experience required.
• Elastic SIEM proficiency for monitoring, triage, and investigation.
• Strong fundamentals in networking, encryption, and vulnerabilities.
• Scripting/automation experience in Python or PowerShell.
• Experience creating/tuning SIEM rules, signatures, and dashboards.
• Excellent written and verbal communication skills.
• Willingness to travel domestically or internationally for short engagements.
• U.S. Passport and at least a Secret clearance required.

Responsibilities

• Monitor networks and detect intrusions using defense tools.
• Operate Elastic SIEM to correlate events and produce actionable intel.
• Develop and tune SIEM content, rules, dashboards, and ML rules.
• Correlate data across network, cloud, and endpoints to identify attacks.
• Triaging alerts and documenting incidents with recommendations.
• Develop threat detection engineering approaches and tune detections.
• Perform phishing analysis and support incident response actions.
• Create scripts to automate investigations and enrich telemetry sources.
• Train customer teams on SIEM usage and investigation workflows.
• Contribute to runbooks, playbooks, and SOC workflow improvements.

Skills

Elastic SIEM

Python/PowerShell

Threat hunting

Analytical thinking

Communication

Travel readiness

US Passport

Security clearance

Tools

Kibana

Logstash

Job description

ECS is seeking a Senior Security Analyst to support at Scott AFB, IL. You will investigate alerts, hunt threats, and operationalize detection across network, cloud, and endpoint telemetry.

You will leverage Elastic SIEM, Kibana, and log pipelines to create detections, dashboards, and automation. Travel for short engagements and direct customer interaction are expected. A Secret clearance and US Passport are required.