Junior Cybersecurity Engineer – Elastic SIEM

About the role

Maximus is currently seeking a Junior Cybersecurity Engineer – Elastic SIEM. This role is onsite, 5 days a week, in San Antonio, TX and requires an active Top Secret / SCI (TS/SCI) security clearance. (TCS056, T2, Band 5)

Responsibilities

• Perform routine tasks under the guidance and review of experienced engineers, following established procedures.
• Assist with administering, operating, and sustaining the Elastic SIEM platform (Elasticsearch, Kibana, Logstash, Beats/Elastic Agent) across NIPRNet, SIPRNet, and JWICS environments.
• Monitor SIEM health, support capacity planning, and troubleshoot routine platform issues using runbooks; escalate outages and complex degradations in accordance with defined SLAs.
• Assist with developing, tuning, and maintaining detection rules, alerts, dashboards, and visualizations in Elastic to support DCO mission requirements.
• Assist with ingesting, normalizing, and validating log data from diverse sources including endpoint, network, cloud, and application telemetry.
• Collaborate with cyber operators and analysts to support threat detection, alert triage, and cyber incident investigation workflows.
• Identify opportunities to improve SIEM coverage, data quality, and detection fidelity; support implementation of approved improvements in coordination with the Government PMO.
• Support Cyber Security Service Provider (CSSP) activities including continuous monitoring and security event analysis.
• Update technical documentation under review including runbooks, standard operating procedures (SOPs), and knowledge base articles.
• Participate in Agile/SAFe Program Increment (PI) planning and sprint execution in support of platform delivery.
• Adhere to Air Force cybersecurity standards and all applicable DoD, IC, and USAF policy and directives across all enclaves.

Requirements

• Active Top Secret / SCI (TS/SCI) security clearance.
• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field (or equivalent experience).
• 3+ years of hands-on cybersecurity engineering experience.
• Basic proficiency level: ability to perform routine Elastic SIEM tasks using established procedures, with supervision and review.
• Demonstrated hands-on experience with Elastic Stack (Elasticsearch, Kibana, Logstash, Beats/Elastic Agent) in an operational SIEM environment.
• Experience supporting threat detection, alert triage, and/or cyber incident investigation.
• Familiarity with DCO concepts, CSSP operations, and defensive cyber frameworks.
• Experience working across multiple network security domains (NIPR, SIPR, or JWICS).
• Meet applicable DoD 8140 requirements for the assigned work role.
• DCWF 521, Cyber Defense Infrastructure Support Specialist, Basic Proficiency; specific required certifications pending contract confirmation.

Skills

• Experience with SIEM/SOAR integrations (e.g., Elastic, Palo Alto Cortex XSOAR, or similar).
• Familiarity with Elastic's Fleet/Agent management and integration development.
• Experience with AWS GovCloud environments (IL4/IL5/IL6).
• Knowledge of MITRE ATT&CK framework and its application to detection engineering.
• Experience with scripting/automation (Python, Bash, KQL/EQL) for SIEM rule development and data pipeline management.
• Familiarity with container-based deployments (Kubernetes/EKS) in classified environments.
• Prior experience supporting USAF or DoD DCO programs.
• One or more of the following certifications preferred: Elastic Certified Engineer, CompTIA CySA+, GCIA, or GCIH.

Benefits

• Health insurance coverage
• Life and disability insurance
• Retirement savings plan
• Paid holidays and paid time off
• Short- and long-term incentives
• Program-specific awards

Pay

Minimum salary: $90,000.00

Maximum salary: $110,000.00

Schedule

Onsite, 5 days per week