SIEM Engineer: Splunk to Elastic Migration Lead

SMX; Fort Meade (MD); On-site; USD 160,000 - 190,000; Full time

Job summary

SMX seeks an experienced SIEM Engineer to implement, configure, and manage SIEM environments and dashboards for real-time visibility across Army Intelligence domains. You will onboard data sources, optimize queries, and ensure security and compliance in a high-security environment.

The role includes leading the Splunk-to-Elastic migration, maintaining high availability, and collaborating with analysts to deliver robust data solutions. Onsite at Ft Meade, MD with TS clearance required.

Qualifications

• Active Top Secret (TS) security clearance with eligibility for SCI and NATO read-on before starting work (and willingness for SAP and CI Poly).
• Splunk Enterprise Certified Architect certification.
• Security+ (or above).
• Bachelor's degree in computer science, Information Technology, or a similar field OR Minimum of 5 years of experience working with Splunk, including installation, configuration, and management.
• 2-3 years of experience in an Elastic SIEM environment.
• Proficiency in managing Splunk components including forwarders, indexers, and search heads.
• Strong understanding of SPL and the capacity to create custom dashboards and reports.
• Experience in data parsing, field extraction, and indexing.

Responsibilities

• Lead migration of SIEM capability from Splunk to Elastic Stack, including planning, stakeholder coordination, and post-migration validation.
• Develop migration roadmap and program schedule with phased cutovers and risk mitigation.
• Onboard new data sources into Splunk and Elastic Stack with proper parsing and indexing.
• Build and optimize dashboards, alerts, and reports for security monitoring and IT operations.
• Develop SPL queries and Elastic queries for advanced analytics.
• Maintain Splunk and Elastic health, performance, and availability.
• Ensure RMF ATO and STIG compliance for the SIEM system.
• Collaborate with analysts and architects to implement use cases for security monitoring and incident response.

Skills

Elastic SIEM

Splunk

SPL

Dashboarding

Data parsing

Education

Bachelor's degree in Computer Science / Information Technology

Minimum 5 years experience with Splunk

Tools

Elastic Stack

Elasticsearch

Logstash

Kibana

Job description

SMX seeks an experienced SIEM Engineer to implement, configure, and manage SIEM environments and dashboards for real-time visibility across Army Intelligence domains. You will onboard data sources, optimize queries, and ensure security and compliance in a high-security environment.

The role includes leading the Splunk-to-Elastic migration, maintaining high availability, and collaborating with analysts to deliver robust data solutions. Onsite at Ft Meade, MD with TS clearance required.