Elasticsearch

Elasticsearch Cybersecurity Jobs

5 jobs found

4d ago

Junior Cybersecurity Engineer – Elastic SIEM

Maximus San Antonio, TX

San Antonio, TX

4d ago

$90k - $110k/yr Full time Cyber Security Elasticsearch Engineer

Apply Now

Job Description

Maximus is hiring a Junior Cybersecurity Engineer to support an Elastic SIEM environment. The position is onsite in San Antonio, TX and requires an active Top Secret / SCI (TS/SCI) security clearance.

Location and Work Schedule

Onsite role
5 days a week in San Antonio, TX

Security Clearance Requirements

Active Top Secret / SCI (TS/SCI) security clearance

Role Details

TCS056, T2, Band 5

Compensation

The salary range for this position is USD 90,000 - 110,000 per year.

Benefits

Health insurance coverage
Life and disability insurance
A retirement savings plan
Paid holidays
Paid time off
Short- and long-term incentives
Program-specific awards

View full job page →

22d ago

Senior Cybersecurity Engineer – Elastic SIEM

Maximus San Antonio, TX

San Antonio, TX

22d ago

$145k - $180k/yr Full time Senior Agent Cybersecurity Tools

Apply Now

Job Description

Maximus offers a mission-focused role supporting defensive cyber operations from the Elastic SIEM stack across multiple classified enclaves. This on-site position in San Antonio, TX supports health insurance coverage, life and disability insurance, a retirement savings plan, paid holidays, and paid time off. If you hold an active TS/SCI clearance, you can help engineer, operate, and sustain SIEM capabilities used for continuous monitoring and security event analysis.

Responsibilities

Lead complex SIEM engineering tasks with minimal supervision while providing technical guidance to the team.
Administer, operate, and sustain the Elastic SIEM platform using Elasticsearch, Kibana, Logstash, and Beats/Elastic Agent across NIPRNet, SIPRNet, and JWICS environments.
Monitor SIEM health, perform capacity planning, and resolve complex platform outages and degradations in accordance with defined SLAs.
Develop, tune, and maintain detection rules, alerts, dashboards, and visualizations in Elastic to support DCO mission requirements.
Ingest, normalize, and validate log data from diverse sources including endpoint, network, cloud, and application telemetry.
Collaborate with cyber operators and analysts to support threat detection, alert triage, and cyber incident investigation workflows.
Identify opportunities to improve SIEM coverage, data quality, and detection fidelity, and lead implementation of improvements in coordination with the Government PMO.
Support CSSP activities, including continuous monitoring and security event analysis.
Create and maintain technical documentation such as runbooks, standard operating procedures (SOPs), and knowledge base articles.
Provide technical guidance and mentoring to journeyman engineers, and review SIEM configurations and detection rules.
Participate in Agile/SAFe Program Increment (PI) planning and sprint execution in support of platform delivery.
Adhere to Air Force cybersecurity standards and all applicable DoD, IC, and USAF policy and directives across all enclaves.

Requirements

Active Top Secret / SCI (TS/SCI) security clearance.
Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or related field (or equivalent experience).
7+ years of hands-on cybersecurity engineering experience.
Advanced proficiency demonstrating experience leading complex Elastic SIEM integrations and troubleshooting, reviewing technical work, and mentoring engineers.
Demonstrated hands-on experience with Elastic Stack (Elasticsearch, Kibana, Logstash, Beats/Elastic Agent) in an operational SIEM environment.
Experience supporting threat detection, alert triage, and/or cyber incident investigation.
Familiarity with DCO concepts, CSSP operations, and defensive cyber frameworks.
Experience working across multiple network security domains (NIPR, SIPR, or JWICS).
Meet applicable DoD 8140 requirements for the assigned work role: DCWF 521, Cyber Defense Infrastructure Support Specialist, Advanced Proficiency (specific required certifications pending contract confirmation).

Preferred Skills and Qualifications

Experience with SIEM/SOAR integrations (e.g., Elastic, Palo Alto Cortex XSOAR, or similar).
Familiarity with Elastic Fleet/Agent management and integration development.
Experience with AWS GovCloud environments (IL4/IL5/IL6).
Knowledge of MITRE ATT&CK framework and its application to detection engineering.
Experience with scripting/automation (Python, Bash, KQL/EQL) for SIEM rule development and data pipeline management.
Familiarity with container-based deployments (Kubernetes/EKS) in classified environments.
Prior experience supporting USAF or DoD DCO programs.
One or more certifications preferred: Elastic Certified Engineer, CompTIA CySA+, GCIA, or GCIH.

Compensation and Location

Salary range: USD 145,000 - 180,000 per year.
Location: San Antonio, TX, United States (onsite).

Accommodations

Maximus provides reasonable accommodations to individuals requiring assistance during any phase of the employment process due to a disability, medical condition, or physical or mental impairment. If you require assistance at any stage of the employment process, including accessing job postings, completing assessments, or participating in interviews, contact People Operations at applicantaccom@maximus.com.

View full job page →

1mo ago

Information Security Engineer

Intuitive Surgical Peachtree Corners, GA

Peachtree Corners, GA

1mo ago Closed

$124k - $210k/yr Full time Cyber Security Data Loss Prevention Data Security

This position is no longer accepting applications (closed Oct 18, 2026).

Job Description

In the IT Security organization at Intuitive Surgical, this role administers and optimizes DLP controls, manages EDR operations and incident response orchestration, and supports zero trust network access enforcement across endpoints, cloud, and network environments.

Key Responsibilities

Administer, tune, and maintain DLP policies and rules within enterprise DLP and SASE/CASB platforms to prevent unauthorized data exfiltration across endpoints, cloud applications, and network egress points.
Deploy, configure, and troubleshoot EDR agents across Windows, macOS, and Linux to ensure consistent sensor health, policy enforcement, and telemetry collection.
Build and maintain SOAR-driven automated incident response and orchestration workflows to support faster alert triage, enrichment, containment, and escalation.
Coordinate with Network Security to implement and enforce ZTNA policy controls, aligning least-privilege access with zero trust architecture principles.
Investigate and respond to DLP alerts, conduct root cause analysis, classify data at risk, coordinate with business stakeholders on policy exceptions, and document findings for compliance and audit needs.
Triage and classify endpoint security events by severity and business impact, correlating telemetry from EDR, SIEM, and DLP systems to identify threats and data exposure risks.
Perform endpoint troubleshooting across Windows, macOS, and Linux, including agent deployment issues, policy conflicts, OS-specific behavioral anomalies, and sensor communication failures.
Develop and refine operational metrics and dashboards in Elasticsearch to track DLP policy effectiveness, endpoint coverage gaps, automation ROI, and incident response performance.
Collaborate with Detection Engineering to create and tune SIEM detection rules addressing DLP bypass techniques, EDR evasion, and insider threat indicators.
Support Incident Response and Investigations teams during escalated security events by providing endpoint forensic data, DLP event context, and automation support throughout the incident lifecycle.
Conduct and support internal security investigations, including insider threat cases, policy violations, and unauthorized data handling, using DLP, EDR, and SIEM platforms for evidence collection and forensic analysis.
Maintain strict confidentiality and discretion when handling sensitive investigation materials, personnel matters, and privileged findings throughout the investigative lifecycle.

Required Qualifications

Minimum 2 years of experience.
Hands-on experience administering and tuning enterprise DLP and SASE/CASB solutions across endpoint, cloud, and network enforcement points.
Experience deploying, managing, and troubleshooting EDR platforms across Windows, macOS, and Linux.
Demonstrated competence in endpoint troubleshooting across Windows, macOS, and Linux, including agent lifecycle management, OS-level diagnostics, and policy conflict resolution.
Understanding of OS internals for Windows, macOS, and Linux, including file systems, process management, registry/plist configuration, logging subsystems, and kernel-level behaviors relevant to security tooling.
Working knowledge of ZTNA concepts and technologies, including identity-aware access controls, micro-segmentation, and least-privilege network policies.
Experience building security automation and orchestration workflows using SOAR platforms for incident triage, enrichment, and response.
Familiarity with SIEM platforms and Elasticsearch for log analysis, alert correlation, and dashboard development.
Strong communication skills to convey technical findings to IT teams, engineering stakeholders, and business partners in a matrixed organization.
Demonstrated ability to handle sensitive and confidential information with discretion, including investigation findings, personnel data, and legal hold materials.
Investigative mindset: attention to detail, methodical evidence handling, objectivity, and the ability to construct a factual narrative from disparate data sources.
Degree in a technical related field (or additional related experience).

Technologies

DLP, SASE/CASB, EDR, SOAR
ZTNA, Elasticsearch, SIEM
Windows, macOS, Linux

Location and Schedule

Location: Peachtree Corners, GA, United States (onsite)
Shift: Day
Workplace type: Set schedule. Onsite weekly, with the percentage of onsite work defined by the leader.

Compensation

Salary range: USD 124,200 - 210,300 per yearly
Base compensation range (Region 1): $146,100 USD - $210,300 USD
Base compensation range (Region 2): $124,200 USD - $178,800 USD

Preferred Skills and Experience

Experience working within a SOC, incident response, or DLP operations function supporting enterprise-level environments.
SANS/GIAC certifications strongly preferred (e.g., GCFE, GCFA, GCED, GCIH, GCIA, GDSA, or GREM). Other certifications such as CISSP or CompTIA Security+ are a plus.
Experience operating across a mature enterprise security stack spanning EDR, DLP, SASE/CASB, SOAR, SIEM, ZTNA, next-generation firewalls, identity providers, and email security gateways.
Demonstrated experience developing automated playbooks for DLP incident handling, endpoint isolation, or threat enrichment workflows.
Understanding of insider threat detection methodologies, data classification frameworks, and regulatory requirements relevant to medical device or healthcare organizations (e.g., HIPAA, FDA).
Prior experience conducting or supporting workplace investigations, forensic examinations, or e-discovery processes in a corporate environment.
Familiarity with chain-of-custody procedures, legal hold requirements, and evidence preservation standards.
Prior systems administration experience across Windows, macOS, or Linux, including working knowledge of Active Directory, group policy, endpoint management, and OS-level security hardening.

Additional Information

Due to the nature of the business and the role, Intuitive and/or its customer(s) may require proof of vaccination against certain diseases (including COVID-19), depending on role requirements.
Intuitive is an Equal Opportunity Employer.
U.S. Export Controls Disclaimer: Some roles may be subject to U.S. export controls for prospective employees who are nationals from countries currently on embargo or sanctions status.
Accommodation & Accessibility Notice: Intuitive provides reasonable accommodations to qualified individuals with disabilities. For assistance during application or interview processes, contact HRHelpNow@intusurg.com.

View full job page →

1mo ago

Data Security Engineer

Leidos Adelphi, MD

Adelphi, MD

1mo ago Closed

$87k - $157k/yr Full time Data Ingestion Data Integration Data Pipeline

This position is no longer accepting applications (closed Sep 28, 2026).

Job Description

Leidos is seeking a Data Security Engineer to support defensive cyber operations by building and sustaining cybersecurity data pipelines. In this hybrid role based in Adelphi, Maryland, you will help ingest, normalize, enrich, and manage high-volume security telemetry to enable analytics and detection workflows across modern data and automation platforms.

The position centers on engineering reliable data flows using the Elastic Stack and integrating with Kafka and CI/CD-driven workflows, with a focus on performance, data quality, and traceability across interconnected systems.

Responsibilities

Design, maintain, and optimize scalable cybersecurity data ingestion and normalization pipelines.
Develop transformations and enrichments for diverse security log and telemetry sources.
Configure and optimize Elasticsearch, Logstash, Kibana, and Fleet for high-volume, high-availability operations.
Maintain index templates, mappings, schemas, and data models that support analytics and detection logic.
Implement data validation, deduplication, and quality controls to ensure data integrity.
Automate ingestion, transformation, and engineering workflows using Python, Bash, and related tools.
Monitor pipeline and indexing performance, troubleshoot data-flow issues, and optimize throughput, storage, and query performance.
Maintain traceability and troubleshoot dependencies across Kafka, Elastic, and CI/CD tooling.
Partner with Detection Engineering, Threat Analysis, Endpoint, and other cyber teams to support operational requirements.
Maintain technical documentation, SOPs, and engineering artifacts.

Requirements

Bachelor’s degree and 4–8 years of relevant experience, or additional experience may substitute in lieu of degree.
3+ years of data engineering, data analysis, cybersecurity data engineering, or related experience.
Experience with data ingestion, transformation, normalization, or high-volume data-processing pipelines.
Experience with technologies such as Elastic Stack, Kafka, Python, Bash, and CI/CD tooling.
Familiarity with Elastic Common Schema (ECS) or similar cybersecurity data models.
Required DoD 8570/8140-aligned and CSSP Analyst certifications, as applicable to the position.
U.S. Citizenship with an active TS/SCI clearance.
Strong written and verbal communication skills.

Technologies

Elastic, Elasticsearch, Logstash, Kibana, Fleet
Elastic Common Schema (ECS)
Kafka
Python, Bash
CI/CD

Benefits

Health and Wellness programs
Income Protection
Paid Leave
Retirement

Preferred Qualifications

Experience onboarding and normalizing high-volume cybersecurity telemetry and log sources.
Experience with Kafka, Python/Bash automation, CI/CD, or DevSecOps practices.
Experience supporting AWS, Azure, GCP, Oracle Cloud, hybrid-cloud, or multi-cloud environments.
Knowledge of cybersecurity operations, including SIEM, threat detection, incident response, and security monitoring.
Experience supporting a DoD CSSP, SOC, or other large-scale defensive cyber operations environment.
Strong troubleshooting skills across complex data pipelines and interconnected systems.

Location: Adelphi, MD (hybrid)
Salary Range: USD 87,100 - 157,450 per year
Minimum Experience: 3 years
Education: Bachelor’s degree
Original Posting Date: August 13, 2026

SECURING YOUR DATA: Leidos will never ask for payment-related information during any part of the employment application process. Leidos will only communicate through emails generated by the Leidos.com automated system. If you receive an email purporting to be from Leidos that requests payment-related information or other personal information, email LeidosCareersFraud@leidos.com. If you believe you are the victim of a scam, contact local law enforcement and report to the U.S. Federal Trade Commission.

COMMITMENT TO NON-DISCRIMINATION: All qualified applicants will receive consideration for employment without regard to sex, race, ethnicity, age, national origin, citizenship, religion, physical or mental disability, medical condition, genetic information, pregnancy, family structure, marital status, ancestry, domestic partner status, sexual orientation, gender identity or expression, veteran or military status, or any other basis prohibited by law. Leidos will also consider for employment qualified applicants with criminal histories consistent with relevant laws.

View full job page →

2mo ago

Security Engineer

Horizontal Talent East Bethel, MN

East Bethel, MN

2mo ago Closed

$57 - $92/hr Full time Automation Containerization Cybersecurity Tools

This position is no longer accepting applications (closed Aug 19, 2026).

Job Description

Security Engineer role in East Bethel, MN onsite, focused on hands-on engineering and Tanium platform administration to strengthen enterprise environments.

Responsibilities

Administer the Tanium platform with emphasis on server administration, module configuration, and ongoing maintenance.
Develop and maintain custom Tanium content, including sensors, packages, and saved questions.
Utilize automation tools such as PowerShell and Python to improve endpoint management workflows.
Integrate with Tanium REST and GraphQL APIs to streamline operations.
Troubleshoot and resolve issues across Windows, macOS, and Linux environments.
Support production environments and manage operational incidents effectively.
Contribute to security logging and observability initiatives through telemetry.

Requirements

Proven Tanium administration experience in large enterprise settings.
Solid knowledge of endpoint security concepts and incident response.
Proficiency in scripting and automation, especially PowerShell and Python.
Experience with Git for source control and collaborative workflows.
Ability to work effectively in a team-oriented environment.

Technologies

Tanium
PowerShell
Python
GraphQL
REST
Git
Logstash
Elasticsearch
Docker
Kubernetes

Benefits

Competitive compensation
Medical, dental, vision, and retirement benefits

View full job page →

Elasticsearch Cybersecurity Jobs

Junior Cybersecurity Engineer – Elastic SIEM

Senior Cybersecurity Engineer – Elastic SIEM

Information Security Engineer

Data Security Engineer

Security Engineer

Get Elasticsearch Cybersecurity Jobs alerts