Senior Cybersecurity Engineer - Elastic SIEM

Maximus TCS (Technology and Consulting Services) Internal Job Profile Code: TCS058, T4, Band 7

Job-Specific Essential Duties and Responsibilities:

- Lead complex SIEM engineering tasks with minimal supervision and provide technical guidance to the team.

- Administer, operate, and sustain the Elastic SIEM platform (Elasticsearch, Kibana, Logstash, Beats/Elastic Agent) across NIPRNet, SIPRNet, and JWICS environments.

- Monitor SIEM health, perform capacity planning, and resolve complex platform outages and degradations in accordance with defined SLAs.

- Develop, tune, and maintain detection rules, alerts, dashboards, and visualizations in Elastic to support DCO mission requirements.

- Ingest, normalize, and validate log data from diverse sources including endpoint, network, cloud, and application telemetry.

- Collaborate with cyber operators and analysts to support threat detection, alert triage, and cyber incident investigation workflows.

- Identify opportunities to improve SIEM coverage, data quality, and detection fidelity; lead implementation of improvements in coordination with the Government PMO.

- Support Cyber Security Service Provider (CSSP) activities including continuous monitoring and security event analysis.

- Create and maintain technical documentation including runbooks, standard operating procedures (SOPs), and knowledge base articles.

- Provide technical guidance and mentoring to journeyman engineers and review SIEM configurations and detection rules.

- Participate in Agile/SAFe Program Increment (PI) planning and sprint execution in support of platform delivery.

- Adhere to Air Force cybersecurity standards and all applicable DoD, IC, and USAF policy and directives across all enclaves.

Job-Specific Minimum Requirements:

- Active Top Secret / SCI (TS/SCI) security clearance.

- Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field (or equivalent experience).

- 7+ years of hands-on cybersecurity engineering experience.

- Advanced proficiency level: demonstrated experience leading complex Elastic SIEM integrations and troubleshooting, reviewing technical work, and mentoring engineers.

- Demonstrated hands-on experience with Elastic Stack (Elasticsearch, Kibana, Logstash, Beats/Elastic Agent) in an operational SIEM environment.

- Experience supporting threat detection, alert triage, and/or cyber incident investigation.

- Familiarity with DCO concepts, CSSP operations, and defensive cyber frameworks.

- Experience working across multiple network security domains (NIPR, SIPR, or JWICS).

- Meet applicable DoD 8140 requirements for the assigned work role.

DCWF 521, Cyber Defense Infrastructure Support Specialist, Advanced Proficiency; specific required certifications pending contract confirmation.

Preferred Skills and Qualifications:

- Experience with SIEM/SOAR integrations (e.g., Elastic, Palo Alto Cortex XSOAR, or similar).

- Familiarity with Elastic's Fleet/Agent manag...