{"id":1922319,"url":"https://alion.io/job/amentum-senior-elastic-stack-data-integration-engineer-ires-ssfbhsv","title":"Senior Elastic Stack Data Integration Engineer IRES - SSFB/HSV","company":{"id":14861,"name":"Amentum","domain":"amentum.com","url":"https://alion.io/company/amentum","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Data Science","role_family":"Data Science","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Colorado Springs, United States","United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":140000,"max":160000,"currency":"USD","period":"year","gross":null,"usd_annual":160000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"Amazon ECS","optional":false},{"name":"Ansible","optional":false},{"name":"Apache Kafka","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Bash","optional":false},{"name":"CI/CD","optional":false},{"name":"Configuration Management","optional":false},{"name":"Elastic SIEM","optional":false},{"name":"ElasticSearch","optional":false},{"name":"GCP","optional":false},{"name":"GitOps","optional":false},{"name":"Kibana","optional":false},{"name":"Linux","optional":false},{"name":"Logstash","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Redis","optional":false},{"name":"SIEM","optional":false},{"name":"Terraform","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-10-05T18:37:00Z","employer_posted_date":"2026-10-05","last_verified_at":"2026-10-13T01:04:58Z","board_verified":true,"closed_at":null,"days_open":7,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":7},"description":"Position Title: Senior Elastic Stack Data Integration Engineer\nLocation: Schriever Space Force Base, Colorado Springs, CO or Redstone Arsenal, Huntsville, AL\nRelocation Assistance: None available at this time\nRemote/Telework: NO - Not available for this position\nClearance Type: DoW Secret\nShift: Day shift\nTravel Required: Up to 10% of the time\nDescription of Duties:\nThe Senior Elastic Stack Data Integration Engineer will serve as the primary technical authority for designing, building, and maintaining data ingestion pipelines supporting Elastic SIEM. This role focuses on creating scalable, resilient Logstash architectures; developing advanced pipeline logic; normalizing, enriching, and transforming security telemetry; and ensuring reliable delivery of high-fidelity data to Elasticsearch.\nKey Responsibilities:\nArchitect, build, and maintain Logstash pipelines to ingest and transform logs from diverse systems, including network devices, servers, cloud services, and security platforms.\nImplement parsing, grok patterns, JSON transformations, conditional routing, enrichment logic, and ECS mapping.\nOptimize pipeline performance, resiliency, and scalability (e.g., persistent queues, pipeline workers, memory tuning, load balancing).\nEnsure all ingested data aligns to ECS (Elastic Common Schema) or internal schema requirements.\nImplement data enrichment workflows (GeoIP, threat intel lookups, metadata injection).\nValidate data completeness, integrity, and fidelity across ingestion flows.\nMaintain and optimize Logstash clusters, including version management, scaling, tuning, and high-availability configurations.\nManage integrations with Beats, Elastic Agent, Kafka, syslog endpoints, and custom data collectors.\nMonitor ingestion throughput, latency, and error rates; implement proactive alerting and troubleshooting processes.\nCreate and maintain technical documentation, including pipeline diagrams, data flow maps, runbooks, and schema references.\nEstablish enterprise standards for parsing, enrichment, normalization, and ingestion patterns.\nSupport internal and external audits by documenting data handling flows and pipeline logic.\nWork closely with SIEM integration engineers to align pipelines with customer environments and logging requirements.\nPartner with detection engineering teams to ensure data supports analytic coverage and rule development.\nCollaborate with infrastructure and platform operations for deployment, scaling, and reliability engineering.\nThe successful candidate will have:\nDeep command of Logstash architecture, patterns, and performance optimization.\nMastery of parsing, enrichment, normalization, and ECS alignment.\nStrong understanding of network protocols, logging patterns, and telemetry generation from enterprise systems.\nAdvanced troubleshooting skills across data ingestion, pipeline logic, and Elastic Stack processing layers.\nCapability to design scalable, HA ingestion workflows with clear operational boundaries.\nAbility to conduct data modeling, schema design, and transformation mapping.\nEffective at interfacing with multiple teams, gathering requirements, and aligning pipeline designs with SIEM analytics needs.\nFocused on reliability, maintainability, and observability across all pipeline components.\nStrong attention to detail and a disciplined approach to documentation, versioning, and configuration management.\nDemonstrated ability to work independently, drive pipeline architecture decisions, and mentor junior engineers.\nStrong documentation, workflow diagramming, and communication skills.\nResumes, in month and year format, must be submitted with application in order to be considered for the position. The selected candidate may be assigned as an employee for one of our teammate companies.\nBasic Requirements:\nMust have 4, or more, years of general (full-time) work experienceMay be reduced with completion of advanced education\n\nMust have 3, or more, years of directly related experience in log ingestion, data engineering, or SIEM pipeline development.\nMust have 2, or more, years of experience working in a management or leadership role\nMust have a strong background in Elastic Stack components (Elasticsearch, Kibana, Beats, Elastic Agent).\nMust have experience with data ingestion, processing, and enrichment techniques.\nMust have hands-on experience ingesting, processing, and normalizing diverse log types (Windows events, syslog, firewall logs, cloud telemetry, security tooling).\nMust be proficient with Linux administration, system-level debugging, and CLI-based operations.\nMust have a DoD 8570.01-M IAT Level II certification with Continuing Education (CE) - (CCNA-Security, CySA+, GICSP, GSEC, Security+ CE, CND, SSCP)\nMust have an active DoW Secret Security Clearance\nMust be able to obtain, and maintain, a DoW Top Secret Security Clearance\nDesired Requirements:\nBe an Elastic Certified Engineer or have relevant Elastic Stack certifications.\nHave strong experience integrating Kafka, Redis, or other message bus technologies into ingestion workflows.\nHave scripting proficiency in Python, Bash, or PowerShell for automation and data validation.\nHave experience designing geo-distributed or multi-cluster ingestion architectures.\nHave knowledge of threat intelligence ingestion, correlation data enrichment, and advanced ECS mapping.\nHave experience with CI/CD pipelines, GitOps workflows, or Infrastructure-as-Code (Terraform, Ansible).\nBe familiar with data quality assurance frameworks and pipeline testing methodologies.\nHave knowledge of cloud-native logging architectures (AWS Firehose, Azure Event Hub, GCP Logging).\nThis position will be posted for a minimum of 3 days. If a candidate has not been selected at that time, it will continue to be posted until a suitable candidate is selected or the position is closed.\nCompensation Details:\n$140,000 - $160,000The compensation range or hourly rate listed for this position is provided as a good-faith estimate of what the company intends to offer for this role at the time this posting was issued. Actual compensation may vary based on factors such as job responsibilities, education, experience, skills, internal equity, market data, applicable collective bargaining agreements, and relevant laws.\nBenefits Overview:\nOur health and welfare benefits are designed to support you and your priorities. Offerings include:\nHealth, dental, and vision insurance\n\nPaid time off and holidays\n\nRetirement benefits (including 401(k) matching)\n\nEducational reimbursement\n\nParental leave\n\nEmployee stock purchase plan\n\nTax-saving options\n\nDisability and life insurance\n\nPet insurance\n\nNote: Benefits may vary based on employment type, location, and applicable agreements. Positions governed by a Collective Bargaining Agreement (CBA), the McNamara-O'Hara Service Contract Act (SCA), or other employment contracts may include different provisions/benefits.\nOriginal Posting:\n10/05/2026 - 10/13/2026Amentum anticipates this job requisition will remain open for at least three days, with a closing date no earlier than three days after the original posting. This timeline may change based on business needs.\nAmentum is proud to be an Equal Opportunity Employer. Our hiring practices provide equal opportunity for employment without regard to race, sex, sexual orientation, pregnancy (including pregnancy, childbirth, breastfeeding, or medical conditions related to pregnancy, childbirth, or breastfeeding), age, ancestry, United States military or veteran status, color, religion, creed, marital or domestic partner status, medical condition, genetic information, national origin, citizenship status, low-income status, or mental or physical disability so long as the essential functions of the job can be performed with or without reasonable accommodation, or any other protected category under federal, state, or local law. Learn more about your rights under Federal laws and supplemental language at Labor Laws Posters.","description_format":"text","description_chars":7958,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":true,"languages":[]},"benefits":["Equity","Life insurance","Parental leave","Relocation assistance","Vision insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":true,"industries":["Military Logistics","Business Process Outsourcing (BPO)","Engineering Services"],"lifecycle":[{"event":"open","at":"2026-10-05T18:37:00Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 2","filings_12m":2,"filings_prev_12m":3,"green_card_filings_12m":0,"median_offered_wage_usd":122500,"route":null,"cap_exempt":false,"checked_at":"2026-10-03T21:08:04+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":30,"band":"fade","label":"Fading","p_open":1,"p_active":0.666,"p_room":0.45,"age_days":6,"expected_fill_days":4,"reasons":["conf:3","velocity","win:tail","comp:brand"],"computed_at":"2026-10-12T06:55:09Z"},"pay":{"stated_usd_annual":160000,"is_top_pay":true},"html_url":"https://alion.io/job/amentum-senior-elastic-stack-data-integration-engineer-ires-ssfbhsv","json_url":"https://alion.io/job/amentum-senior-elastic-stack-data-integration-engineer-ires-ssfbhsv.json","meta":{"generated_at":"2026-10-13T01:20:07Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1986,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":14861},"rest":"https://alion.io/mcp/rest/get_company?id=14861"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Famentum-senior-elastic-stack-data-integration-engineer-ires-ssfbhsv"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Famentum-senior-elastic-stack-data-integration-engineer-ires-ssfbhsv"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Famentum-senior-elastic-stack-data-integration-engineer-ires-ssfbhsv"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/amentum-senior-elastic-stack-data-integration-engineer-ires-ssfbhsv\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Famentum-senior-elastic-stack-data-integration-engineer-ires-ssfbhsv"}]}