Cyber Data Analysis Engineer (Elasticsearch)

About the role

CACI is hiring a Cyber Data Analysis Engineer (Elasticsearch) in Springfield, Missouri, a full-time regular position requiring a minimum TS/SCI clearance. The engineer designs, builds and maintains the enterprise environment that collects, stores and displays log data supporting cybersecurity efforts, working with on-premise and cloud systems and products to gather log data from multiple government agencies in compliance with policy.

Key responsibilities

• Help customers route log data through enterprise networks to a specific destination.
• Design, build and maintain log data collection pipelines using products such as Cribl, ArcSight, Kafka, AWS products, Linux and Microsoft servers.
• Design, build and maintain log data management environments using Elasticsearch or Sentinel.
• Troubleshoot data flow, display and storage issues from the SIEM collection point to the SIEM or long-term storage, and perform root cause analysis.
• Research and identify physical or cloud resources needed to support Linux systems or hosted products.
• Design health indicators to monitor platform uptime and maintain application, system and product versions per agency policy.
• Develop or improve processes with scripts, Ansible or AWS products, document tasks and changes, train teammates and respond to customer inquiries.

Required profile

• Active Top Secret/SCI clearance with US Government contract experience and a polygraph, or ability to pass one.
• Bachelor's degree in Computer Science, Information Technology or a related field with 6 years of relevant experience, or equivalent experience in lieu of a degree.
• DOD 8570 IAT Level II certification, and ability to obtain a CSSP Infrastructure Support certification within 90 days of hire.
• 3+ years of Unix/Linux server administration, 2+ years of Windows server administration and 2+ years of SIEM administration (Elasticsearch, Splunk, Sentinel, ArcSight).
• Good oral and written communication and listening skills; up to 10% local travel; occasional on-call duty including nights and weekends.

Required skills

• SIEM administration (Elasticsearch, Splunk, Sentinel, ArcSight)
• Unix/Linux and Windows server administration
• Desired: LAN/WAN networking, Kafka, Kubernetes, Cribl, Ansible, AWS (EC2, S3, NLB/ALB), regular expressions, scripting (YAML, Python, JavaScript, Bash, Ruby) and Git

What we offer

• Proposed pay range of $82,100 to $172,400, depending on location, experience and skills.
• Healthcare, wellness, financial, retirement, family support, continuing education and time-off benefits.
• A flexible time-off benefit and learning resources.