About This Role
Protecting an organization's data, networks, and IT infrastructure from cyber-attacks is the core of this technical role. You will focus on proactive defense by creating secure architectures and automated defenses, designing, building, and maintaining systems.
Responsibilities
- Design and deploy firewalls, intrusion detection systems or intrusion prevention systems (IDS/IPS), and encryption protocols
- Conduct regular penetration tests and security audits to identify and patch system weaknesses
- Perform Identity and Access Management (IAM), including implementing policies to ensure only authorized users can access sensitive company data
- Lead or assist in the technical response to security breaches, including digital forensics and damage mitigation
- Create and enforce company-wide security standards such as password management and data classification
- Develop relationships quickly and easily with other teams, communicating the complexities of security with a wide variety of audiences, including senior management
- Manage infrastructure and cybersecurity controls, including enhanced detection and vulnerability capabilities and improved event correlation in large enterprises
- Lead risk and vulnerability assessments in network, system, and application areas
- Leverage big data analytics and traditional security event types to identify advanced threats or indicators of compromise
Requirements
- 6+ years of experience administering Elastic Stack, including Elasticsearch, Kibana, Logstash, Beats, or Fleet
- Experience managing Elasticsearch index lifecycle policies, index templates, and data streams at scale, and building Kibana dashboards, visualizations, and lens-based analytics for security operations
- Experience with Elastic Security detection rules, alerts, and case management workflows
- Experience with log ingestion pipeline design, including parsing, enrichment, and normalization across heterogeneous log sources such as network, endpoint, identity, and cloud
- Experience with Elastic Common Schema (ECS) and mapping non-standard log sources into ECS-compliant fields
- Experience with ES|QL or EQL for advanced threat hunting and detection-as-code workflows
- Experience working in a DoD, IC, or federal cybersecurity environment such as SOC, SIEM operations, or defensive cyber
- Secret clearance
- HS diploma or GED
Nice to have:
- Experience building SOAR-related automation around Elastic, including webhook actions, connector integrations, or n8n or XSOAR orchestration
- Experience with Elastic's transforms and runtime fields for creating enriched security datasets and risk scoring indices
