Cyber Data Analysis Engineer (Elasticsearch)

Description

The role builds and runs the enterprise setup that gathers, stores and displays cybersecurity data.

You will work across on-premise and cloud systems and a range of software to pull log data from several government agencies, in line with policy, and keep it stored so it can be retrieved easily.

The team is looking for people who are driven, precise, open to learning, willing to pass on what they know, organised with their time, and careful with records.

Responsibilities

• Help customers route their log data across one or more enterprise networks to its target.
• Build, run and maintain log collection pipelines made from tools such as Cribl, ArcSight, Kafka, various AWS services, and Linux and Microsoft servers.
• Build, run and maintain log management environments on products such as Elasticsearch or Sentinel.
• Find the physical or cloud resources needed to better support specific Linux systems or hosted products.
• Fix data flow problems between the SIEM collection point and the SIEM or the chosen long-term storage.
• Fix data display and storage problems inside the SIEM environment.
• Carry out root cause analysis on complex issues.
• Define and build indicators of system health that support maximum uptime, and monitor platform health proactively.
• Keep application, system and product versions aligned with agency enterprise policies.
• Improve or create processes using scripts, Ansible or AWS products.
• Write up tasks, processes, changes and product statuses.
• Train the team on tasks and products.
• Work with internal and external customers through every project phase.
• Stay aware of customer needs and answer their inquiries in a timely manner.
• Pay close attention to detail.
• Occasional on-call duty, including nights and weekends, though this is very rare.

Requirements

• Active Top Secret/SCI clearance with experience on US Government contracts and a polygraph, or the ability to pass a polygraph.
• Bachelor's degree in Computer Science, Information Technology or a related field with 6 years of relevant experience, or relevant experience in place of a degree.
• DOD 8570 IAT Level II certification.
• Ability to obtain CSSP Infrastructure Support certification within 90 days of hire.
• 3 or more years of Unix/Linux server administration or similar experience.
• 2 or more years of Windows server administration or similar experience.
• 2 or more years of SIEM administration on platforms such as Elasticsearch, Splunk, Sentinel, ArcSight, etc.
• Solid speaking and writing skills.
• Good listening and comprehension.
• Desired: 1+ years in one or more of LAN/WAN networking, Kafka, Kubernetes, Cribl, Ansible, AWS (EC2, S3, NLB/ALB), or Regular Expressions (RegEx).
• Desired: experience with one or more scripting languages: YAML, Python, JavaScript, Bash, or Ruby.
• Desired: experience using version control tools such as Git.

Conditions

Full-time, regular position.

Minimum clearance required to start is TS/SCI.

Travel is up to 10% and local.

Some on-call work, including nights and weekends, though this is very rare.

The proposed salary range is $82,100-$172,400.

Final pay depends on factors such as location, Federal Government contract labor categories and wage rates, prior experience, specific skills, education, and certifications.

The range shown is the national average because the role can be based in more than one location.

The company values flexibility that helps employees balance their work and personal lives.

Benefits

• Comprehensive benefits covering healthcare, wellness, financial, retirement, family support, continuing education, and time off.
• Flexible time off so you can take the time you need.
• Access to learning and development resources.
• Competitive compensation.