Enterprise Logging Solution (ELS) Engineer

Description

The company is a technology firm that supports the US federal government, serving defense, national security, public safety, civilian, and military health clients. The team is more than 13,000 people.

This role supports the Enterprise Logging Solution (ELS) and SIEM environment, which gives System Owners, ISSM/ISSOs, and the SOC centralized security monitoring and audit and reporting. The work covers architecture, implementation, and ongoing operations and maintenance, both on-premise and in the cloud.

As an engineer, you will evaluate and build out proposed ELS/SIEM changes, move streaming-ingestion architecture into cloud and on-premise settings, and bring newly added systems into the platform through a defined data design, collection, and ingestion-testing process. You will also tune correlation rules and signatures and add ML and AI capabilities to the Agency's SIEM.

Responsibilities

• Analyze, build, and test proposed ELS/SIEM enhancements against vendor and industry best practices. Check current capabilities against the Agency's security and logging rules on a regular basis and run gap analyses.
• Migrate and implement ELS/SIEM architecture in cloud, on-premise, or both. Design and integrate streaming processing for data onboarding and ingestion.
• Write implementation plans, communications plans included, for approved changes. Set up and verify test configurations, and bring change requests to Change Control Board meetings.
• Onboard new systems with System Owners, ISSOs, and the Government ELS Team Lead. Cover data design requirements, collection, and ingestion scheduling and testing.
• Build dashboards for System Owners, ISSM/ISSOs, executives, and developers. Keep a Master Project Schedule and review it every two weeks with Government leadership.
• Maintain collection and aggregation of IDS, firewall, proxy, DLP, antivirus, cloud log, and vulnerability scanner data. Run streaming ingestion and analysis tools.
• Write correlation rules, signatures, and risk-based scoring improvements. Maintain whitelists and blacklists to keep the SIEM well tuned.
• Build, deploy, or integrate Machine Learning (ML) and Artificial Intelligence (AI) into the Agency's ELS/SIEM.
• Support users of ELS/SIEM dashboards, including the ISSO audit dashboard, and respond to system outages and data feed problems.

Requirements

• At least 5 years of experience in system administration, database administration, network engineering, software engineering, or software development with a focus on cybersecurity. A bachelor's degree in Computer Science, Engineering, Information Technology, Cybersecurity, or a related field can replace part of this, but you still need 5 years of such experience.
• Preferred: Splunk Certified Admin.

Conditions

Office location, role, skill set, and experience level affect pay. The base pay range for this role in California, Colorado, Connecticut, Hawaii, Illinois, Maine, Maryland, Massachusetts, Minnesota, New Jersey, New York, Ohio, Vermont, Virginia, Washington, and the District of Columbia is $91,700 - $178,700 USD.

Applications are accepted on an ongoing basis, with no fixed deadline.

Equal opportunity is a core commitment of the company.

Benefits

• A wide range of benefits is offered. Details are available on the company's benefits page.