Elastic SIEM Platform Engineer

Salary: $170,000 - 210,000 per year Requirements: At least five years of experience in cybersecurity, systems engineering, network engineering, or a related technical field. At least two years of hands-on experience engineering or operating Elastic Stack environments, or equivalent experience demonstrating the ability to perform the role. Practical knowledge of Elasticsearch cluster architecture, Kibana, Fleet, Elastic Agents, ingest pipelines, data lifecycle management, monitoring, and troubleshooting. Experience securing enterprise platforms using TLS, certificates, identity integration, role-based access, and logical data separation. Linux administration experience, preferably with Red Hat Enterprise Linux, and knowledge of platform tuning, including memory, storage, swap, vm.max_map_count, and ulimits. Experience in DoD, federal, classified, or other highly regulated environments, including applying RMF, STIG, and NIST security controls. Experience supporting DoD CSSP or comparable SOC operations across multiple network enclaves. Ability to explain technical issues clearly, work with customers, document solutions, and support time-sensitive migration and cutover activities. Active Secret clearance and ability to maintain required access; candidates supporting JWICS activities must be eligible for applicable TS/SCI access. Ability to travel regularly to Fort Belvoir, Virginia, including on short notice for customer access, classified work, testing, or operational milestones. Elastic Certified Engineer is strongly preferred at hire. Official Elasticsearch Engineer training and substantial hands-on experience may be considered instead, provided certification can be obtained within 90 days of hire or assignment. Elastic Certified Analyst and Elastic Certified Observability Engineer certifications are preferred and may be obtained after assignment, depending on program needs. A DoD 8140- or 8570-aligned baseline certification, such as Security+ or an approved higher-level certification, is preferred or must be obtained as required for the assigned position category. Preferred: residence within commuting distance of Fort Belvoir or the National Capital Region; active TS/SCI clearance and prior SIPRNet or JWICS work; experience with Elastic self-managed, bare-metal, cloud, Kubernetes, Docker, or hybrid deployments; Splunk-to-Elastic SIEM migration experience; high-volume security data, snapshots, object storage, backup, recovery, or multi-site resilience experience; defensive cyber operations, incident response, network analytics, threat hunting, forensics, or detection engineering experience; scripting, APIs, or infrastructure automation experience; and experience providing technical instruction, operational briefings, and knowledge transfer. Active United States citizenship and at least a DoD Secret clearance are required. Responsibilities: Design, deploy, configure, upgrade, and maintain self-managed Elastic Stack environments, including Elasticsearch, Kibana, Fleet, Elastic Agents, Beats, Logstash, and related integrations. Support the phased migration of priority data sources, searches, dashboards, detections, alerts, and analyst workflows from Splunk to Elastic Security. Build and troubleshoot ingest pipelines, parsers, index templates, data streams, mappings, and Index Lifecycle Management policies for high-volume security telemetry. Monitor and optimize cluster health, capacity, performance, availability, shard allocation, retention, snapshots, and recovery. Implement secure access and data protection, including TLS or mTLS, certificate management, CAC or enterprise identity integration, role-based access, Kibana spaces, and data segregation. Develop and improve dashboards, detection rules, alerting, and threat-hunting content aligned with mission use cases and MITRE ATT&CK. Integrate Elastic with endpoint, network, vulnerability, identity, ticketing, and security automation technologies used by the Agency CSSP. Deploy and troubleshoot in disconnected, air-gapped, and classified environments, including use of offline repositories and controlled software transfer processes. Participate in customer workshops, testing, dual-run validation, cutover, and post-migration optimization at Fort Belvoir and other approved locations. Create architecture, configuration, test, operating, troubleshooting, and knowledge-transfer documentation; train government and contractor personnel as needed. Deliver secure, operational, supportable Elastic Security capabilities across authorized Agency environments, with reliable normalized telemetry and validated dashboards, detections, alerts, and analyst workflows. Document configuration, testing, troubleshooting, and operating procedures to support migration, cutover, and ongoing operations. Technologies: Cloud Docker ElasticSearch Support Kibana Kubernetes Linux Network Security Splunk API DevOps PowerShell Python More: We are partnering with hackajob to recruit an Elastic Cyber Defense Platform Engineer for our prime contract with the Defense Threat Reduction Agency. This hands-on role supports the migration from Splunk to an enterprise Elastic Security platform and its ongoing operation across three network enclaves, working closely with customer stakeholders, cybersecurity analysts, infrastructure teams, and program leadership. The position is based at Fort Belvoir, Virginia, in a professional office environment, with a Monday–Friday, 8:00 a.m.–4:00 p.m. schedule and typically one to two weeks of annual travel. The role may involve occasional deployment or training travel. The target salary range is $170,000–$210,000; actual compensation depends on individual qualifications, contract parameters, and organizational requirements. We offer full-time employees health, dental, and vision coverage, a 401(k), life insurance, short- and long-term disability plans, vacation, and holidays. Employees must comply with vaccination requirements mandated by contract, law, or regulation. The position includes regular physical activities such as standing, walking, sitting, reaching, and handling objects, as well as lifting items up to 50 pounds; reasonable accommodations may be available. last updated 41 week of 2026