> Markdown version of [/jobs/ext/1113076-seim-engineer](https://www.wearedevelopers.com/jobs/ext/1113076-seim-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# SEIM Engineer

- **Company:** Apex Systems LLC
- **Location:** Fort Meade, MD, United States
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Big Data, Domain Name System (DNS), Elasticsearch, Identity and Access Management, Intrusion Detection and Prevention, Intrusion Detection Systems, Pcap, Log Analysis, NetFlow, Network Monitoring, Network Protocols, Open Systems Interconnection (OSI), Logstash, Security Information and Event Management, TCP/IP, Wireshark, Data Logging, Cyber Threat Analysis, Kibana, Splunk, Data Pipelines, Elk Stack
- **Published:** June 3, 2026
- **Apply:** https://www.clearancejobs.com/jobs/8947773/seim-engineer

## About the Role

Bachelor's Degree with 8-15 years of relevant experience, or equivalent professional experience.
An active IAT Level II or III Certification.
Experience with Splunk, including SPL query development, dashboard creation, and alert tuning.
Experience supporting or participating in SIEM platform migrations, preferably from Splunk to Elastic.
Familiarity with Elastic/ELK Stack tools such as Elasticsearch, Kibana, Logstash, and Beats.
Knowledge of network protocols (TCP/IP, OSI) and cyber threat methodologies.
Experience analyzing netflow, PCAP, and custom application logging data.
Experience with security tools such as Wireshark, passive DNS, and threat intelligence platforms.
Preferred Qualifications
Experience supporting DISN or DOW networks.
Demonstrated experience building SIEM dashboards, analytics, and detection content in Splunk and/or Elastic.
Hands-on experience with Splunk to Elastic migrations, data pipeline validation, or detection engineering conversions.
Familiarity with intelligence-driven defense methodologies.
IAT Level III and/or IAM Level II/III Certifications.

## Description

Our organization is seeking a SIEM Engineer to support a critical enterprise migration from Splunk to Elastic. This role will serve as a senior analyst, responsible for developing queries, tuning alerts, and performing advanced analysis within a large-scale environment. The position involves translating existing security use cases, dashboards, and alerts while ensuring detection capabilities are maintained or improved throughout the transition., Serve as a senior SIEM analyst leveraging Splunk, with responsibility for query development (SPL), alert tuning, correlation, and advanced analysis.
Support and contribute to enterprise SIEM migration efforts from Splunk to Elastic, including translating use cases, dashboards, and alerts.
Validate data ingestion pipelines and log sources during the migration to ensure fidelity.
Leverage network monitoring and detection capabilities (netflow, PCAP, IDS) to identify adversary activity.

 * Perform advanced log analysis, correlation, and threat detection across large-scale datasets.

Discover adversary campaigns, anomalies, and inconsistencies across SIEM platforms.
Support the development of cyber fusion frameworks aligned with best practices.
Analyze and document malicious actor TTPs, mapping them to enterprise vulnerabilities.
Produce detailed analytic reports and visualizations to communicate findings.
Provide mitigation strategies to reduce risk and improve the enterprise security posture.


## Related Videos

- [Better Together: Leveraging Your Observability Tools as a SIEM](https://www.wearedevelopers.com/videos/2118-better-together-leveraging-your-observability-tools-as-a-siem)
- [Debug a Kubernetes Operator](https://www.wearedevelopers.com/videos/487-debug-a-kubernetes-operator)
- [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture)
- [Add Location-based Searching to Site with ElasticSearch](https://www.wearedevelopers.com/videos/77-add-location-based-searching-to-site-with-elasticsearch)
- [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data)
- [Serverless Observability: where SLOs meet transforms](https://www.wearedevelopers.com/videos/854-serverless-observability-where-slos-meet-transforms)

## Related Articles

- [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again)
- [Highest Paying Tech Companies for Developers](https://www.wearedevelopers.com/magazine/220-highest-paying-tech-companies-for-developers)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Top-Paying Tech Jobs (with Salaries)](https://www.wearedevelopers.com/magazine/372-top-paying-tech-jobs-with-salaries)
- [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)
- [Software Engineer Career: Things You Should Know](https://www.wearedevelopers.com/magazine/143-software-engineer-career-things-you-should-know)