> Markdown version of [/jobs/ext/2227626-siem-administrator-engineer](https://www.wearedevelopers.com/jobs/ext/2227626-siem-administrator-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # SIEM Administrator/Engineer - **Company:** Science Applications International Corporation - **Location:** Washington, DC, United States - **Experience:** Experienced - **Salary:** $80,001.0 - $120,000.0 - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Application Programming Interfaces (APIs), Data Analysis, Bash Shell, Cyber Security, Information Systems, Databases, Data Validation, Database Queries, Query Languages, Linux, Domain Name System (DNS), Elasticsearch, Hypertext Transfer Protocols (HTTP), Statistical Hypothesis Testing, Intrusion Detection and Prevention, Intrusion Detection Systems, Python (Programming Language), Network Security, Linux Commands, Log Analysis, Parsing, Performance Tuning, Windows PowerShell, Cloud Services, Logstash, Kusto Query Language, Standard Sql, Security Information and Event Management, SQL Databases, Syslog, TCP/IP, Software Vulnerability Management, Data Logging, Scripting, In-Plane Switching (IPS), Data Ingestion, Mitre Att&ck, Indexer, Firewalls (Computer Science), Information Technology, Cybercrime, Data Analytics, Kibana, Restful APIs, Splunk - **Published:** August 25, 2026 - **Apply:** https://www.careerarc.com/job-listing/saic-jobs-siem-administrator-engineer-52966154 ## About the Role * Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical discipline (4 years experience in lieu of degree) * 5+ years experience relevant IT/cybersecurity experience. * Ability to obtain and maintain a public trust requiring U.S. Citizenship or Green Card * 3+ years of hands-on SIEM administration experience supporting enterprise or similarly complex environments. * Hands-on experience with Splunk Enterprise, including SPL, data ingestion, forwarders, indexes, searches, dashboards, alerts, and platform troubleshooting. * Experience onboarding and troubleshooting enterprise log sources and understanding telemetry flow from source systems through collection, ingestion, indexing, and search. * Working knowledge of SQL and experience querying data for analysis, troubleshooting, validation, or reporting. * Experience with or working knowledge of Elastic, Elasticsearch, Kibana, or comparable search and analytics technologies, with the ability to rapidly develop deeper Elastic expertise. * Understanding of enterprise logging concepts, including collection, parsing, normalization, enrichment, indexing, retention, and data quality. * Strong Linux command-line skills and working knowledge of Windows/Linux systems, networking, and common protocols such as TCP/IP, DNS, HTTP/HTTPS, TLS, and syslog. * Familiarity with enterprise cybersecurity technologies such as EDR, firewalls, IDS/IPS, identity systems, and vulnerability management platforms. * Demonstrated ability to independently troubleshoot technical problems, analyze unfamiliar data, test assumptions, identify root causes, and develop practical solutions. * Strong technical curiosity, ownership, accountability, and ability to learn new technologies, platforms, and query languages. * Strong written and verbal communication skills with the ability to document technical processes and collaborate effectively across teams., * Hands-on experience with Elastic Stack / Elastic Security, including Elasticsearch, Kibana, Elastic Agent/Fleet, Beats, or Logstash. * Experience with KQL, ES|QL, EQL, Query DSL, or comparable search and analytics languages. * Experience supporting a SIEM migration, particularly Splunk-to-Elastic or a comparable enterprise migration. * Experience with Splunk ES, Splunk CIM, Elastic Common Schema (ECS), or distributed Splunk environments. * Experience with security detection engineering, correlation rules, alert tuning, threat hunting, or MITRE ATT&CK. * Experience with scripting or automation using Python, PowerShell, Bash, REST APIs, or similar technologies. * Experience working in or closely supporting a Security Operations Center (SOC). * Relevant technical certifications such as Splunk, Elastic, Security+, CySA+, GSEC, or comparable certifications. ## Description Description SAIC is seeking a SIEM Administrator / Engineer to support enterprise cybersecurity operations and the modernization of the agency's security monitoring and analytics capabilities. This position will provide hands-on administration of the organization's existing Splunk environment while helping transition security monitoring, log analytics, and detection capabilities to Elastic / Elastic Security. The ideal candidate has strong hands-on SIEM administration experience and is ready to grow into a broader engineering role. The successful candidate should be able to independently administer and troubleshoot production SIEM and logging infrastructure while demonstrating the technical curiosity, critical thinking, ownership, and initiative necessary to solve problems and improve the environment. ***This hybrid role requires a minimum of three on-site days per week in Washington, DC.*** Responsibilities * Administer, maintain, monitor, and troubleshoot the existing Splunk Enterprise / Splunk ES environment while supporting the implementation and operationalization of Elastic / Elastic Security. * Support the organization's transition from Splunk to Elastic, including migration and validation of data sources, searches, dashboards, reports, alerts, and security use cases. * Configure, manage, and troubleshoot enterprise log ingestion pipelines, including syslog, Windows Event Collection/Forwarding, Splunk forwarders, Elastic agents, network and security devices, applications, databases, cloud services, and APIs. * Onboard new data sources and ensure telemetry is reliably collected, parsed, normalized, enriched, indexed, and searchable using applicable standards such as Splunk CIM and Elastic Common Schema (ECS). * Troubleshoot logging and telemetry issues across the complete data path, from the originating system through collection, transport, ingestion, indexing, and search. * Develop, maintain, and optimize SIEM searches, dashboards, reports, alerts, and security detections using SPL and Elastic query technologies, including KQL, ES|QL, EQL, and Query DSL as applicable. * Use SQL and other query languages to analyze data, validate results, troubleshoot integrations, and support cybersecurity investigations and reporting. * Monitor and optimize SIEM platform health, performance, storage, ingestion, retention, and capacity. * Work with security analysts and cybersecurity engineers to develop, test, tune, and improve security monitoring and detection capabilities. * Investigate technical problems, test hypotheses, identify root causes, and implement or recommend practical solutions. * Use scripting, APIs, and automation where appropriate to improve SIEM administration, monitoring, data onboarding, and repetitive operational processes. * Maintain technical documentation and take ownership of assigned technical issues and projects through resolution. Qualifications Requirements * Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical discipline (4 years experience in lieu of degree) * 5+ years experience relevant IT/cybersecurity experience. * Ability to obtain and maintain a public trust requiring U.S. Citizenship or Green Card * 3+ years of hands-on SIEM administration experience supporting enterprise or similarly complex environments. * Hands-on experience with Splunk Enterprise, including SPL, data ingestion, forwarders, indexes, searches, dashboards, alerts, and platform troubleshooting. * Experience onboarding and troubleshooting enterprise log sources and understanding telemetry flow from source systems through collection, ingestion, indexing, and search. * Working knowledge of SQL and experience querying data for analysis, troubleshooting, validation, or reporting. * Experience with or working knowledge of Elastic, Elasticsearch, Kibana, or comparable search and analytics technologies, with the ability to rapidly develop deeper Elastic expertise. * Understanding of enterprise logging concepts, including collection, parsing, normalization, enrichment, indexing, retention, and data quality. * Strong Linux command-line skills and working knowledge of Windows/Linux systems, networking, and common protocols such as TCP/IP, DNS, HTTP/HTTPS, TLS, and syslog. * Familiarity with enterprise cybersecurity technologies such as EDR, firewalls, IDS/IPS, identity systems, and vulnerability management platforms. * Demonstrated ability to independently troubleshoot technical problems, analyze unfamiliar data, test assumptions, identify root causes, and develop practical solutions. * Strong technical curiosity, ownership, accountability, and ability to learn new technologies, platforms, and query languages. * Strong written and verbal communication skills with the ability to document technical processes and collaborate effectively across teams. Preferred Qualifications * Hands-on experience with Elastic Stack / Elastic Security, including Elasticsearch, Kibana, Elastic Agent/Fleet, Beats, or Logstash. * Experience with KQL, ES|QL, EQL, Query DSL, or comparable search and analytics languages. * Experience supporting a SIEM migration, particularly Splunk-to-Elastic or a comparable enterprise migration. * Experience with Splunk ES, Splunk CIM, Elastic Common Schema (ECS), or distributed Splunk environments. * Experience with security detection engineering, correlation rules, alert tuning, threat hunting, or MITRE ATT&CK. * Experience with scripting or automation using Python, PowerShell, Bash, REST APIs, or similar technologies. * Experience working in or closely supporting a Security Operations Center (SOC). * Relevant technical certifications such as Splunk, Elastic, Security+, CySA+, GSEC, or comparable certifications. Target salary range: $80,001 - $120,000. The estimate displayed represents the typical salary range for this position based on experience and other factors. ## Related Videos - [Better Together: Leveraging Your Observability Tools as a SIEM](https://www.wearedevelopers.com/videos/2118-better-together-leveraging-your-observability-tools-as-a-siem) - [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture) - [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [Docker exec without Docker](https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker) - [Discover the open source trio you didn’t expect: .NET and PostgreSQL on Linux](https://www.wearedevelopers.com/videos/2042-discover-the-open-source-trio-you-didn-t-expect-net-and-postgresql-on-linux) ## Related Articles - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Top-Paying Tech Jobs (with Salaries)](https://www.wearedevelopers.com/magazine/372-top-paying-tech-jobs-with-salaries) - [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology) - [The Most Popular IT Jobs on the Market](https://www.wearedevelopers.com/magazine/376-the-most-popular-it-jobs-on-the-market) - [The 12 Best Jobs for Software Engineers](https://www.wearedevelopers.com/magazine/401-the-12-best-jobs-for-software-engineers)