FREE ACCESS
5,000–10,000 jobs/day
See all jobs on Scoutfield
Search thousands of fresh jobs every day.
Discover
- Fresh listings
- Fast filters
- No subscription required
Create a free account and start exploring right away.
Core Competencies
Role fitCore Competencies
Use this summary to align your resume positioning with the role.
Demonstrates extensive experience in administering and engineering enterprise SIEM platforms, particularly Splunk and Elastic, with a strong focus on data ingestion, performance optimization, and security telemetry management. Proficient in developing technical documentation and collaborating with cross-functional teams to drive technical initiatives and solutions.
Highest-signal resume keywords
SIEM AdministrationSplunk EnterpriseElastic SecuritySPL ProficiencyLinux Administration
ATS Keywords
Tailor your resumeApplicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.
Hard Skills
SIEM ArchitectureData IngestionPerformance OptimizationSecurity Telemetry ManagementScriptingAutomationTechnical DocumentationTroubleshootingData NormalizationCorrelation Rules
Soft Skills
Technical CuriosityAccountabilityCommunicationCollaborationProblem-Solving
Tools & Technologies
Splunk CIMElastic ECSKibanaLogstashREST APIsWindowsLinuxTCP/IPDNSHTTP/HTTPS
Certifications & Qualifications
Splunk Enterprise Certified AdminSplunk Enterprise Certified ArchitectElastic Certified EngineerSecurity+CISSP
Industry Keywords
CybersecurityNISTFISMAOMBFedRAMPEDRIDS/IPSVulnerability ManagementCloud EnvironmentsDistributed Systems
Tech Stack
Tools & technologiesCloudCyber SecurityDistributed SystemsDNSElasticSearchFirewallsLinuxLogstashPythonSplunkSQLTCP/IP
About the role
Key responsibilities & impact- Administer, maintain, engineer, and optimize enterprise SIEM platforms, including Splunk Enterprise, Splunk ES, and Elastic / Elastic Security
- Support SIEM architecture and modernization initiatives, including the transition from Splunk to Elastic, migration of data sources and security use cases, infrastructure design, testing, validation, and operational cutover
- Design, configure, manage, and troubleshoot enterprise log collection and ingestion pipelines
- Onboard and normalize security telemetry, ensuring accurate collection, parsing, enrichment, indexing, retention, and searchability using Splunk CIM and Elastic ECS
- Develop, maintain, migrate, and optimize SIEM searches, dashboards, reports, alerts, correlation rules, and security detections using SPL, SQL, and Elastic query technologies
- Monitor and optimize SIEM infrastructure health, ingestion performance, storage utilization, system capacity, and data availability
- Support high availability, disaster recovery, and scalability requirements
- Troubleshoot complex SIEM and logging issues across the complete data path, identify root causes, and implement sustainable solutions
- Support SIEM architecture, configuration management, security hardening, change control, automation, and platform lifecycle management
- Collaborate with security analysts, infrastructure teams, application owners, and cybersecurity leadership
- Develop and maintain technical documentation, including architecture diagrams, data flow diagrams, configuration standards, SOPs, and migration procedures
- Provide technical guidance to other team members
- Evaluate emerging SIEM technologies and recommend solutions improving performance, automation, scalability, and operational efficiency
- Own assigned technical initiatives, communicate progress and risks, and independently drive technical issues and projects through resolution
Requirements
What you’ll need- Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical discipline; OR equivalent relevant IT/cybersecurity experience
- 9+ years of relevant IT or cybersecurity experience, including at least 3 years of hands-on SIEM administration, engineering, or enterprise logging experience
- Ability to obtain and maintain a Public Trust requiring U.S. Citizenship
- Demonstrated experience administering, engineering, or troubleshooting enterprise SIEM platforms, with hands-on experience in Splunk Enterprise and working knowledge of Elastic or comparable search and analytics technologies
- Strong understanding of SIEM architecture, distributed systems, enterprise logging, data ingestion, parsing, normalization, indexing, retention, and performance optimization
- Proficiency with Splunk Search Processing Language (SPL), working knowledge of SQL, and familiarity with Elastic query technologies such as KQL, ES|QL, EQL, or Query DSL
- Experience onboarding and troubleshooting enterprise data sources, including Windows/Linux systems, network devices, security appliances, applications, and cloud environments
- Strong Linux and Windows administration skills, including working knowledge of networking, TCP/IP, DNS, HTTP/HTTPS, TLS, syslog, and related protocols
- Experience with scripting or automation using Python, PowerShell, Bash, REST APIs, or comparable technologies
- Familiarity with enterprise cybersecurity technologies such as EDR, firewalls, IDS/IPS, identity systems, vulnerability management, and security monitoring platforms
- Demonstrated ability to independently investigate complex technical problems, analyze data, identify root causes, and develop practical engineering solutions
- Strong technical curiosity, initiative, accountability, and ability to learn new technologies while adapting to evolving enterprise requirements
- Excellent written and verbal communication skills, with the ability to document technical solutions and collaborate effectively with technical teams and leadership
- Preferred: Hands-on experience with Elastic Stack / Elastic Security, including Elasticsearch, Kibana, Elastic Agent/Fleet, Beats, Logstash, and Elastic query technologies
- Preferred: Experience with distributed or cloud-based SIEM architectures, including clustering, high availability, disaster recovery, storage optimization, and capacity planning
- Preferred: Experience supporting enterprise SIEM migrations, particularly Splunk-to-Elastic
- Preferred: Advanced experience with Splunk Enterprise / Splunk ES, including distributed architectures, CIM, search optimization, and platform administration
- Preferred: Experience with security detection engineering, correlation rules, alert tuning, MITRE ATT&CK, or security analytics development
- Preferred: Familiarity with configuration management, Infrastructure-as-Code, Git, CI/CD, and automated platform deployments
- Preferred: Experience supporting cybersecurity operations within federal environments and familiarity with NIST, FISMA, OMB, and FedRAMP requirements
- Preferred: Relevant technical certifications such as Splunk Enterprise Certified Admin, Splunk Enterprise Certified Architect, Elastic Certified Engineer, Security+, CISSP, or comparable certifications