2 months ago
Colorado Springs, CO, USASenior
Base Salary
$140k - $160k/yr
Responsibilities
- Architect, build, maintain, and optimize Logstash pipelines for ingesting and transforming diverse enterprise, network, cloud, and security logs.
- Implement parsing, grok patterns, JSON transformations, conditional routing, enrichment, and ECS or internal schema mapping.
- Optimize Logstash performance, resiliency, scalability, persistent queues, pipeline workers, memory usage, load balancing, and high-availability configurations.
- Manage integrations with Beats, Elastic Agent, Kafka, syslog endpoints, and custom data collectors.
- Monitor ingestion throughput, latency, and errors while developing alerting, troubleshooting, validation, and data-quality processes.
- Create technical documentation including pipeline diagrams, data-flow maps, runbooks, and schema references.
- Establish enterprise standards for parsing, normalization, enrichment, ingestion, and configuration management.
- Collaborate with SIEM integration, detection engineering, infrastructure, platform operations, and customer-facing teams.
- Support audits and mentor junior engineers while independently driving pipeline architecture decisions.
Requirements
- At least 4 years of general full-time work experience, potentially reduced through advanced education.
- At least 3 years of directly related experience in log ingestion, data engineering, or SIEM pipeline development.
- At least 2 years of experience in a management or leadership role.
- Strong Elastic Stack experience, including Elasticsearch, Kibana, Beats, and Elastic Agent, with deep Logstash architecture and performance knowledge.
- Hands-on experience ingesting, processing, enriching, and normalizing diverse logs such as Windows events, syslog, firewall logs, cloud telemetry, and security-tool data.
- Proficiency with Linux administration, system-level debugging, and command-line operations.
- DoD 8570.01-M IAT Level II certification with Continuing Education, such as CCNA-Security, CySA+, GICSP, GSEC, Security+ CE, CND, or SSCP.
- Active DoW Secret clearance and ability to obtain and maintain a DoW Top Secret clearance.
- Preferred qualifications include Elastic certification, Kafka or Redis integration, Python, Bash, or PowerShell scripting, geo-distributed or multi-cluster architecture, threat-intelligence enrichment, ECS mapping, CI/CD, GitOps, Terraform, Ansible, pipeline testing, and cloud-native logging experience with AWS, Azure, or GCP.
Benefits
- Health, dental, and vision insurance.
- Paid time off and holidays.
- Retirement benefits including 401(k) matching.
- Educational reimbursement, parental leave, employee stock purchase plan, tax-saving options, disability and life insurance, and pet insurance.
- On-site work is required at Schriever Space Force Base in Colorado Springs, Colorado, or Redstone Arsenal in Huntsville, Alabama; remote and telework are unavailable.
- Relocation assistance is not available, and travel is required up to 10% of the time.
- The posting originally runs from 09/15/2026 through 09/24/2026, though it may remain open until a suitable candidate is selected.
Tech Stack
Categories
Data Engineering
About Amentum
Amentum provides engineering, operations and maintenance, logistics, and mission support services to U.S. federal agencies and allied governments, including defense and energy programs. Its business centers on large, long-term government contracts spanning defense, space, nuclear cleanup, and infrastructure, with program management and technical services at the core. Headquartered in Chantilly, Virginia, it was formed in 2020 from the spinoff of AECOM’s Management Services division.