Cybersecurity Data Engineer
Job Description
In this Cybersecurity Data Engineer role, you will help SPECIAL AEROSPACE SECURITY SERVICES INC build and operate high-availability cybersecurity data pipelines within the Elastic ecosystem. The work focuses on configuring ingestion, storage, retrieval, and scalable ETL processes so security teams can rely on timely, high-quality data for operational needs.
The position is based in Fort Meade, MD with an onsite work arrangement. You will collaborate across cybersecurity teams while designing transformations, maintaining index structures, and supporting performance and data integrity across the full data flow.
Key Responsibilities
- Configure and optimize data ingestion, storage, and retrieval using Elasticsearch, Logstash, Kibana, and Fleet to support high-volume, high-availability operations.
- Design, maintain, and optimize scalable cybersecurity ETL pipelines using the Elastic toolchain.
- Develop transformations and enrichments for a variety of security log and telemetry sources.
- Maintain index templates, mappings, schemas, and data models that support analytics and detection logic.
- Implement data validation, deduplication, and quality controls to preserve data integrity.
- Automate ingestion, transformation, and engineering workflows with Python, Bash, and related tools.
- Monitor pipeline and indexing performance, troubleshoot data-flow issues, and optimize throughput, storage, and query performance.
- Maintain traceability and troubleshoot dependencies across Kafka, Elastic, and CI/CD tooling.
- Partner with Detection Engineering, Threat Analysis, Endpoint, and other cyber teams to support operational requirements.
- Maintain technical documentation, SOPs, and engineering artifacts.
Required Qualifications
- TS clearance
Technologies
- Elasticsearch, Logstash, Kibana, Fleet
- Elastic
- Python, Bash
- Kafka, CI/CD
- Ruby
- AWS, Azure, GCP, Oracle Cloud
Nice to Have
- Experience with Kafka, Python/Bash automation, CI/CD, or DevSecOps practices.
- Experience supporting Ruby.
- Experience working with AWS, Azure, GCP, Oracle Cloud, and hybrid or multi-cloud environments.
- Knowledge of cybersecurity operations, including SIEM, threat detection, incident response, and security monitoring.