Sr. SIEM Engineer (Elastic + Confluent) bei Accenture Federal Services
Accenture Federal Services · Virginia, Vereinigte Staaten Von Amerika · Remote
Join Accenture Federal Services, a technology company and part of global Accenture, to do work that matters in a collaborative and caring community, where you feel like you belong and are empowered to grow, learn and thrive through hands-on experience, certifications, industry training and more.
Join us to drive positive, lasting change that moves missions and the government forward!
We are:
Accenture Federal Services, bringing together commercial innovation with the latest technology to unleash the potential for our federal clients. Every day we bring bold thinking and diverse disciplines to solve problems in new ways. Ready to learn as much as you can We’ll give you numerous opportunities from informal training sessions to courses and certifications to keep your tech smarts sharp.
You are:
AFS is seeking a Sr. SIEM Engineer specializing in Elastic Stack and Confluent in support of the PEO Enterprise SIEM Consolidation / Cyber Defense effort. This effort is focused on the consolidation of PEO Enterprise multiple SIEM solutions (approx. 40) into one consolidated SIEM. This individual should have extensive experience with Security Information and Event Management (SIEM) deployment and tuning as well as Security Orchestration Automation and Response (SOAR) development and implementation.
Responsibilities:
- Design, deploy, configure, and maintain Elastic stack and Confluent deployments
- Manage, patch, and upgrade Elasticsearch, Confluent, and other related systems
- Tune and optimize Elastic stack deployments based on application/customer needs
- Design and configure ETL data pipelines to ingest customer defined data sets such as application logs, metrics, and or threat events
- Create custom visualizations and dashboards using Kibana
- Configure and maintain index templates and information lifecycle management (ILM) policies
- Develop Elastic alerting solutions using Watcher and/or Kibana Rules and Connectors with integrations to ticketing systems, email, and messaging apps as required
- Develop Machine Learning (ML) jobs to dynamically monitor and alert on identified metrics, KPIs, and/or data anomalies
- Follow ITIL based change management processes to move solutions from Dev to Test and into Production
- Run the day-to-day operations of the security operations center
- Investigate incidents and lead response efforts as applicable
Required Skills:
- Secret clearance is required to maintain this position
- Compliance with one of the DoD 8140 / 8570 IAT Level II certification prior to start date (CompTIA Security+ CE, CySA+, CCNA Security, GSEC, GICSP)
- 3+ years of hands-on experience in deployment, configuration, and solution development using the Elastic Stack for security and logging use-cases
- Demonstrated experience with the full Elastic Stack: Elasticsearch, Logstash, Kibana, Beats, Machine Learning, and REST API integration
- Experience in developing data structures and data mapping from various sources to achieve data normalization using Elastic Common Schema
- Experience developing Logstash and/or Elastic Ingest Pipelines
- Experience developing custom visualizations and dashboards using Kibana, including creating specialized reporting solutions through Elasticsearch and Kibana APIs to meet complex stakeholder requirements
- Certified Elastic Engineer or willingness to gain certification within 90 days of hire
Desired Skills:
- Experience using and developing Ansible playbooks for automation of system deployment and/or configuration
- Experience with developing in multiple languages (Python, Bash, PowerShell, Painless, etc.)
- Understanding of the MITRE ATT&CK framework
- Experience with cloud environments (e.g., Azure, AWS, GCP, etc.) and cloud security architecture
- Experience integrating Elasticsearch with external systems (e.g., SOAR tools, Threat Intel Platforms) and alternate authentication mechanisms such as SAML, LDAP, and PKI
- Experience with data management: hot/warm/cold architectures, shared allocation/re-allocation, snapshots & restoration
- Strong experience with evaluating existing Elastic clusters, configuration parameters, indexing, search and query performance tuning, security, and cluster administration
- Experience supporting the Elastic Stack in on-prem and SaaS environments, including system monitoring and tuning, securing the Elastic Stack, and hardening hosting environments
- Experience with the design and implementation of highly scalable solutions using the Elastic Stack
- Experience in end-to-end low-level design, development, administration, and delivery of Elasticsearch-based reporting solutions
- Strong technical foundation in building reliable, scalable, and supportable systems
- Experience in Red Hat Enterprise Linux deployment and administration
Eligibility Requirements:
US Citizen
#LI-Remote #LI-Defense
As required by local law, Accenture Federal Services provides reasonable ranges of compensation for hired roles based on labor costs in the states of California, Colorado, Hawaii, Illinois, Maryland, Massachusetts, Minnesota, New Jersey, New York, Washington, Vermont, the District of Columbia, and the city of Cleveland. The base pay range for this position in these locations is shown below. Compensation for roles at Accenture Federal Services varies depending on a wide array of factors, including but not limited to office location, role, skill set, and level of experience. Accenture Federal Services offers a wide variety of benefits. You can find more information on benefits here. We accept applications on an on-going basis and there is no fixed deadline to apply.
