{"id":2782215,"url":"https://alion.io/job/saic-siem-engineer","title":"SIEM Engineer","company":{"id":58788,"name":"SAIC","domain":"saic.com","url":"https://alion.io/company/saic","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Oracle","truth_index":{"grade":"B","score":81,"open_postings":57,"ghost_share":0,"stale_share":0.947,"repost_share":0,"time_to_fill_p50_days":15,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"staff","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Washington, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":135000,"max_usd":269000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":376},"experience_years_min":9,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Amazon ECS","optional":false},{"name":"Bash","optional":false},{"name":"DNS","optional":false},{"name":"Elastic SIEM","optional":false},{"name":"Linux","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"SQL","optional":false},{"name":"TCP/IP","optional":false},{"name":"Windows","optional":false},{"name":"CI/CD","optional":true},{"name":"ElasticSearch","optional":true},{"name":"FedRAMP","optional":true},{"name":"Git","optional":true},{"name":"Kibana","optional":true},{"name":"Logstash","optional":true},{"name":"MITRE ATT&CK","optional":true}],"status":"live","first_seen_at":"2026-10-16T17:16:43Z","employer_posted_date":"2026-10-16","last_verified_at":"2026-10-18T01:37:05Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"SIEM Engineer\nSAIC is seeking a SIEM Engineer to support enterprise cybersecurity operations and the modernization of the agency's security monitoring and analytics capabilities. This position is responsible for administering, engineering, and optimizing enterprise Security Information and Event Management (SIEM) platforms within a mission-critical federal environment.\nThe ideal candidate combines strong hands-on SIEM administration experience with engineering and architectural knowledge. The successful candidate should be capable of independently troubleshooting complex technical problems, improving platform performance and reliability, and contributing to the design of scalable SIEM solutions. Strong analytical skills, technical curiosity, initiative, and a commitment to continuous improvement are essential.\nHYBRID: 3 days onsite / 2 days remote\nResponsibilities\nAdminister, maintain, engineer, and optimize enterprise SIEM platforms, including Splunk Enterprise, Splunk ES, and Elastic / Elastic Security, ensuring availability, performance, reliability, and scalability.\nSupport SIEM architecture and modernization initiatives, including the transition from Splunk to Elastic, migration of data sources and security use cases, infrastructure design, testing, validation, and operational cutover.\nDesign, configure, manage, and troubleshoot enterprise log collection and ingestion pipelines, including syslog, Windows Event Collection/Forwarding, SIEM agents and forwarders, network devices, security technologies, applications, databases, and cloud services.\nOnboard and normalize security telemetry, ensuring accurate collection, parsing, enrichment, indexing, retention, and searchability using applicable standards such as Splunk Common Information Model (CIM) and Elastic Common Schema (ECS).\nDevelop, maintain, migrate, and optimize SIEM searches, dashboards, reports, alerts, correlation rules, and security detections using SPL, SQL, and Elastic query technologies.\nMonitor and optimize SIEM infrastructure health, ingestion performance, storage utilization, system capacity, and data availability while supporting high availability, disaster recovery, and scalability requirements.\nTroubleshoot complex SIEM and logging issues across the complete data path, identify root causes, and implement sustainable solutions to improve reliability and operational effectiveness.\nSupport SIEM architecture, configuration management, security hardening, change control, automation, and platform lifecycle management in accordance with enterprise and federal requirements.\nCollaborate with security analysts, infrastructure teams, application owners, and cybersecurity leadership to improve security visibility, detection capabilities, data quality, and operational reporting.\nDevelop and maintain technical documentation, including architecture diagrams, data flow diagrams, configuration standards, SOPs, and migration procedures, while providing technical guidance to other team members.\nEvaluate emerging SIEM technologies and capabilities, identify opportunities for engineering improvements, and recommend solutions that improve performance, automation, scalability, and operational efficiency.\nTake ownership of assigned technical initiatives, communicate progress and risks, and independently drive technical issues and projects through resolution.\n Requirements\nBachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical discipline; OR equivalent relevant IT/cybersecurity experience.\n\n9+ years of relevant IT or cybersecurity experience, including at least 3 years of hands-on SIEM administration, engineering, or enterprise logging experience.\n\nAbility to obtain and maintain a Public Trust requiring U.S. Citizenship.\n\nDemonstrated experience administering, engineering, or troubleshooting enterprise SIEM platforms, with hands-on experience in Splunk Enterprise and working knowledge of Elastic or comparable search and analytics technologies.\n\nStrong understanding of SIEM architecture, distributed systems, enterprise logging, data ingestion, parsing, normalization, indexing, retention, and performance optimization.\n\nProficiency with Splunk Search Processing Language (SPL), working knowledge of SQL, and familiarity with Elastic query technologies such as KQL, ES|QL, EQL, or Query DSL.\n\nExperience onboarding and troubleshooting enterprise data sources, including Windows/Linux systems, network devices, security appliances, applications, and cloud environments.\n\nStrong Linux and Windows administration skills, including working knowledge of networking, TCP/IP, DNS, HTTP/HTTPS, TLS, syslog, and related protocols.\n\nExperience with scripting or automation using Python, PowerShell, Bash, REST APIs, or comparable technologies.\n\nFamiliarity with enterprise cybersecurity technologies such as EDR, firewalls, IDS/IPS, identity systems, vulnerability management, and security monitoring platforms.\n\nDemonstrated ability to independently investigate complex technical problems, analyze data, identify root causes, and develop practical engineering solutions.\n\nStrong technical curiosity, initiative, accountability, and ability to learn new technologies while adapting to evolving enterprise requirements.\n\nExcellent written and verbal communication skills, with the ability to document technical solutions and collaborate effectively with technical teams and leadership..\n\nPreferred Qualifications\nHands-on experience with Elastic Stack / Elastic Security, including Elasticsearch, Kibana, Elastic Agent/Fleet, Beats, Logstash, and Elastic query technologies.\n\nExperience with distributed or cloud-based SIEM architectures, including clustering, high availability, disaster recovery, storage optimization, and capacity planning.\n\nExperience supporting enterprise SIEM migrations, particularly Splunk-to-Elastic, including data source migration, detection migration, and operational validation.\n\nAdvanced experience with Splunk Enterprise / Splunk ES, including distributed architectures, CIM, search optimization, and platform administration.\n\nExperience with security detection engineering, correlation rules, alert tuning, MITRE ATT&CK, or security analytics development.\n\nFamiliarity with configuration management, Infrastructure-as-Code, Git, CI/CD, and automated platform deployments.\n\nExperience supporting cybersecurity operations within federal environments and familiarity with NIST, FISMA, OMB, and FedRAMP requirements.\n\nRelevant technical certifications such as Splunk Enterprise Certified Admin, Splunk Enterprise Certified Architect, Elastic Certified Engineer, Security+, CISSP, or comparable certifications.","description_format":"text","description_chars":6704,"description_truncated":false,"requirements":{"experience_years_min":9,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Security Operations","Digital Government","Systems Integrators","Engineering Services"],"lifecycle":[{"event":"open","at":"2026-10-17T13:16:11Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":15,"reasons":["conf:0","win:early","comp:brand"],"computed_at":"2026-10-18T02:01:41Z"},"pay":null,"html_url":"https://alion.io/job/saic-siem-engineer","json_url":"https://alion.io/job/saic-siem-engineer.json","meta":{"generated_at":"2026-10-18T02:01:41Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":3309,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-19T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":58788},"rest":"https://alion.io/mcp/rest/get_company?id=58788"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsaic-siem-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsaic-siem-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsaic-siem-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/saic-siem-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsaic-siem-engineer"}]}