Senior Elastic Stack Data Integration Engineer

Amentum

. Serve as the primary technical authority for designing, building, and maintaining data ingestion pipelines supporting Elastic SIEM .

Posted 9/15/2026full-timeColorado Springs • Alabama • United StatesSenior💰 $140,000 - $160,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in designing and maintaining data ingestion pipelines, particularly with Elastic SIEM and Logstash. Proficient in data processing, enrichment techniques, and ensuring data integrity while collaborating with cross-functional teams.

Highest-signal resume keywords

Elastic Stack ComponentsLogstash Pipeline DevelopmentData Ingestion TechniquesLinux AdministrationDoD 8570.01-M IAT Level II Certification

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

LogstashData IngestionData ProcessingJSON TransformationsGrok PatternsPipeline OptimizationScripting in PythonScripting in BashScripting in PowerShellCI/CD Pipelines

Soft Skills

MentoringCollaborationProblem-SolvingTechnical Documentation

Tools & Technologies

Elastic SIEMElasticsearchKibanaBeatsElastic AgentKafkaRedisAWS FirehoseAzure Event HubGCP Logging

Certifications & Qualifications

DoD 8570.01-M IAT Level II CertificationElastic Certified Engineer

Industry Keywords

Data EngineeringLog IngestionSecurity ClearanceThreat IntelligenceECS Mapping

Tech Stack

Tools & technologies

AnsibleAWSAzureCloudElasticSearchGoogle Cloud PlatformKafkaLinuxLogstashPythonRedisTerraform

About the role

Key responsibilities & impact

Serve as the primary technical authority for designing, building, and maintaining data ingestion pipelines supporting Elastic SIEM
Architect, build, and maintain Logstash pipelines ingesting and transforming logs from network devices, servers, cloud services, and security platforms
Implement parsing, grok patterns, JSON transformations, conditional routing, enrichment logic, and ECS mapping
Optimize pipeline performance, resiliency, and scalability using persistent queues, pipeline workers, memory tuning, and load balancing
Ensure ingested data aligns with Elastic Common Schema or internal schema requirements
Implement data enrichment workflows including GeoIP, threat intelligence lookups, and metadata injection
Validate data completeness, integrity, and fidelity across ingestion flows
Maintain and optimize Logstash clusters, including version management, scaling, tuning, and high-availability configurations
Manage integrations with Beats, Elastic Agent, Kafka, syslog endpoints, and custom data collectors
Monitor ingestion throughput, latency, and error rates; implement proactive alerting and troubleshooting processes
Create and maintain technical documentation, including pipeline diagrams, data flow maps, runbooks, and schema references
Establish enterprise standards for parsing, enrichment, normalization, and ingestion patterns
Support internal and external audits by documenting data handling flows and pipeline logic
Work with SIEM integration engineers to align pipelines with customer environments and logging requirements
Partner with detection engineering teams to support analytic coverage and rule development
Collaborate with infrastructure and platform operations on deployment, scaling, and reliability engineering
Work independently, drive pipeline architecture decisions, and mentor junior engineers

Requirements

What you’ll need

4 or more years of general full-time work experience; may be reduced with completion of advanced education
3 or more years of directly related experience in log ingestion, data engineering, or SIEM pipeline development
2 or more years of experience working in a management or leadership role
Strong background in Elastic Stack components, including Elasticsearch, Kibana, Beats, and Elastic Agent
Experience with data ingestion, processing, and enrichment techniques
Hands-on experience ingesting, processing, and normalizing diverse log types, including Windows events, syslog, firewall logs, cloud telemetry, and security tooling
Proficiency with Linux administration, system-level debugging, and CLI-based operations
DoD 8570.01-M IAT Level II certification with Continuing Education, such as CCNA-Security, CySA+, GICSP, GSEC, Security+ CE, CND, or SSCP
Active DoW Secret Security Clearance
Ability to obtain and maintain a DoW Top Secret Security Clearance
Elastic Certified Engineer or relevant Elastic Stack certifications preferred
Experience integrating Kafka, Redis, or other message bus technologies preferred
Scripting proficiency in Python, Bash, or PowerShell preferred
Experience designing geo-distributed or multi-cluster ingestion architectures preferred
Knowledge of threat intelligence ingestion, correlation data enrichment, and advanced ECS mapping preferred
Experience with CI/CD pipelines, GitOps workflows, or Infrastructure-as-Code, including Terraform and Ansible, preferred
Familiarity with data quality assurance frameworks and pipeline testing methodologies preferred
Knowledge of cloud-native logging architectures, including AWS Firehose, Azure Event Hub, and GCP Logging, preferred
Resume submitted in month and year format required
Must be able to work day shift and travel up to 10% of the time

Benefits

Comp & perks

Health, dental, and vision insurance
Paid time off and holidays
Retirement benefits, including 401(k) matching
Educational reimbursement
Parental leave
Employee stock purchase plan
Tax-saving options
Disability and life insurance
Pet insurance