Elastic SIEM Administrator

Peraton is seeking a talented and experienced Elastic SIEM Administrator to join our team in support of the U.S. Army Europe Regional Cyber Center (RCC-E) in Wiesbaden Germany.

Location: on-site Wiesbaden Germany

Role & Job Description:

• As a SIEM Administrator you are responsible for administering and supporting the Elastic Stack cluster including all pipeline-related services to ensure reliability scalability and continued capability development.
  • A key component of this role is documentation: you will develop and maintain comprehensive materials on system operations pipeline architecture and service delivery processes.
    Primary Responsibilities:
• You will operate monitor and maintain multi-siteElastic clusters across multiple network enclaves.
• Administer Confluent Kafka environments and associated Logstash pipeline services.
• Build and manage configurations and filters for Elastic Beats and Elastic Agent collection architectures.
• Develop maintain and update documentation for system architecture pipeline designs operational procedures and service offerings.
• Support Defensive Cyber Operations by assisting with analytic development and data pipeline optimization.
• Contribute to the ongoing development and enhancement of Elastic Stack capabilities.

#RCC-E

Minimum requirements:

• Must meet Technical Expert Status Accreditation (TESA) and Peraton qualifications for the role which can be achieved through one of the following pathways:
  • A bachelors degree in a STEM field or in Business Administration plus 5 years of relevant specialized experience.
  • An associate degree plus 7 years of specialized experience.
  • 11 years of relevant specialized experience with HS Diploma/Equivalent
• Certifications:
  • DoD-Intermediate (one of: GMON GRID CEH CISSP-ISSAP CISSP-ISSEP Cloud CySA GCIA GICSP GSEC PenTest Security or SSCP)
  • One of the following residential requirements (one of Elastic Certification Splunk Enterprise Certified Admin Splunk Certified Architect Microsoft Certified Cybersecurity Architect Expert ArcSight ESM Advanced Administrator Certified or GDSA)
• Demonstrated experience with Elastic SIEM including Elastic and Kibana.
• Experience writing and troubleshooting complex regular expressions.
• Experience developing and maintaining custom ingest pipelines and normalizing disparate data sets.
• Experience administering the Linux operating system.
• Experience building and maintaining Kafka topics and supporting technologies.
• Strong understanding of data models and SIEM standardized compliance frameworks.
• Experience organizing and orchestrating data set migrations with affected users.
• Ability to provide advanced SIEM query language support to various content owners.
• Experience creating and maintaining administrative dashboards.
• U.S. citizenship required.
• Active Top Secret clearance with SCI eligibility.

Preferred qualifications

• Be an Elastic Certified Engineer or Elastic Certified Observability Engineer.
• Demonstrate experience supporting multi-sitearchitectures.
• Demonstrate experience with Elastic Agent.
• Demonstrate extensive knowledge of Lucene language.
• Experience with Git GitLab Azure DevOps GitHub or other project configuration management.

Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the worlds leading mission capability integrator and transformative enterprise IT provider we deliver trusted highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land sea space air and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day our employees do the cant be done by solving the most daunting challenges facing our customers. Visit to learn how were keeping people around the world safe and secure.