SIEM Engineer-Elastic Remote / Telecommute Jobs
ICS is hiring a SIEM Engineer to support onsite in Hanover MD. This position has been approved for hybrid support (2 days onsite/3 days remote).
This is a hybrid position 2 days onsite every week.
An active Secret OR Top secret is required.
SIEM Duties & Responsibilities
Duties & Responsibilities for this position include:
• This is a technical, hands-on role responsible for the successful operation of a variety of cybersecurity tools, logging framework, and cybersecurity infrastructure
• Support written technical deliverables for customers and build new capabilities
• Contributions to infrastructure, data pipeline, analytics dashboards, and other resources will be delivered to threat analysts for consumption
• Enhance the Joint Staff’s ability to secure systems and networks through implementation of the Elastic product family’s SIEM tool
• Facilitate data ingestion of logs including Extract, Transform, and Load (ETL) functions to develop dashboards, visualization, and alerting
• Create Standard Operation Procedures (SOPs) and perform index administration, maintenance and optimization
• Develop daily and weekly PowerPoint presentations to brief management and the team
• Ability to analyze security vulnerability reports and develop/implement a plan to mitigate critical vulnerabilities.
• Experience with developing automated capabilities for securing environments.
• STIG compliance and vulnerability management
• Knowledge of JFQ DoDIN DoD 8510.01 RMF IA Controls (IACs) and implementation.
• Engagement with avenues of influence (Splunk product managers, user groups, ) to align platform capabilities with business requirements
• Requires an extensive knowledge of application or infrastructure systems architecture, usually having experience with multiple system technologies
• Recognizes and seizes opportunities to improve products, services or approaches
• Design, document, build, secure, and maintain Elastic Stack solutions deployed in the Cloud or on-premises
• Experience using SIEM/SORN technologies
Elastic SIEM Qualifications
Education
• Bachelor's degree in Information Security or related field and/or equivalent combination of experience.
Experience
• 5+ years of experience in information technology or security engineering
• 3+ years of direct Elastic administration experience
Certification
• DoD 8140/8570 IAT Level II/III certifications required
• One or more certifications:
o GIAC Certified Detection Analyst (GCDA)
o CompTIA Cybersecurity Analyst (CySA+)
o Elastic Certified Engineer
o Elastic Certified Analyst
o Elastic Certified Observability Engineer
o Certified SOC Analyst (EC-CSA)
o Security+
Clearance
• Minimum Secret
• Ability to obtain and maintain Top Security/SCI clearance
