Enterprise Logging Solution (ELS) Engineer

Description

The company is a technology firm within a global parent organization and works only with the US federal government, serving defense, national security, public safety, civilian, and military health clients with a workforce of 13,000+ people.

This senior role supports the Agency's central security monitoring and audit and reporting tools, the Enterprise Logging Solution (ELS) and SIEM platform.

You will build and test ELS/SIEM improvements, bring streaming ingestion into cloud and on-premise settings, add new systems, build dashboards for different stakeholders, and keep a Master Project Schedule.

The work also covers tuning correlation rules, maintaining whitelists and blacklists, and adding ML and AI capabilities.

Responsibilities

• Build and test planned ELS/SIEM changes using vendor and industry best practices.
• Compare current capabilities with security and logging regulations and identify gaps.
• Move and set up ELS/SIEM architecture across cloud and on-premise environments.
• Design and connect streaming processing for data onboarding and ingestion.
• Write implementation plans and bring change requests to Change Control Board meetings.
• Bring new systems into ELS/SIEM, covering data design requirements and ingestion testing.
• Build dashboards for System Owners, ISSM/ISSO staff, executives, and developers.
• Keep the SIEM fed by IDS, firewall, proxy, DLP, antivirus, cloud log, and vulnerability scanner sources.
• Write correlation rules, signatures, and risk-based scoring improvements.
• Develop, deploy, and connect ML and AI to the Agency's ELS/SIEM.
• Support users of the ELS/SIEM dashboards and respond to outages and data-feed problems.

Requirements

• Minimum 5 years of experience in system administration, database administration, network engineering, software engineering, or software development with a focus on cyber security. Alternatively, a bachelor's degree in Computer Science, Engineering, Information Technology, Cybersecurity, or a related field plus 3 years of such experience.
• Active TS/SCI clearance.
• Splunk Certified Admin.

Conditions

TS/SCI clearance is required because of elevated-access programs.

Pay range of $81,000 - $162,400 USD applies in California, Colorado, Connecticut, Hawaii, Illinois, Maine, Maryland, Massachusetts, Minnesota, New Jersey, New York, Ohio, Vermont, Virginia, Washington, and the District of Columbia.

Actual pay depends on factors such as office location, role, skill set, and experience level.

Applications are accepted on an ongoing basis with no fixed deadline.

The company is committed to equal opportunity and an inclusive workplace.

Benefits

• The company offers a wide range of benefits.