SIEM & UEBA Engineer (Mid) - Federal

Koniag Services, Inc.; Washington, Northern (District of Columbia, KY); Hybrid; USD 110,000 - 150,000; Full time

Benefits offered by this job

Health, dental & vision insurance

401K with company match

Flexible spending accounts

Paid holidays

3 weeks paid time off

Job summary

Koniag Data Solutions, a Koniag Government Services company, is seeking an experienced SIEM/UEBA Engineer (Mid) to support enterprise cybersecurity operations for a federal government client. This role requires an active clearance or the ability to obtain and maintain a government background investigation prior to performing work.

Primary work will be performed at the client site in Washington DC with approved remote/telework locations.

Qualifications

• Bachelor's degree or equivalent in a relevant field and 3–5 years of hands-on SIEM/UEBA experience.
• Active security clearance or ability to obtain and maintain clearance.
• Experience administering and engineering enterprise SIEM platforms including onboarding, parsing, detection rule creation, and alert tuning.

Responsibilities

• Administer, engineer, and maintain enterprise SIEM and UEBA platforms across a federal IT environment.
• Design and maintain log ingestion architectures onboarding diverse log sources.
• Develop parsers, extraction configurations, and data normalization mappings.
• Monitor platform health, ingestion reliability, and capacity planning.
• Support SIEM upgrades, changes, and documentation.
• Develop and maintain UEBA use cases and behavioral models.
• Create dashboards and analytics views for incident response and threat hunting.

Skills

SIEM platforms

UEBA platform

detection content development

log ingestion

threat intelligence integration

Education

Bachelor's degree in Cybersecurity, CS, IT, or related field

Tools

Splunk

Microsoft Sentinel

IBM QRadar

Elastic SIEM

Python / scripting

Job description

Koniag Data Solutions, a Koniag Government Services company, is seeking an experienced SIEM/UEBA Engineer (Mid) to support enterprise cybersecurity operations for a federal government client. This role requires an active clearance or the ability to obtain and maintain a government background investigation prior to performing work.

Primary work will be performed at the client site in Washington DC with approved remote/telework locations.