Elasticsearch Engineer (Secret Clearance)

Who we are:

ShorePoint is a fast-growing, industry recognized and award-winning cybersecurity services firm with a focus on high-profile, high-threat, private and public-sector customers who demand experience and proven security models to protect their data. ShorePoint subscribes to a “work hard, play hard” mentality and celebrates individual and company successes. We are passionate about our mission and going above and beyond to deliver for our customers. We are equally passionate about an environment that supports creativity, accountability, diversity, inclusion and a focus on giving back to our community.  

The Perks:

As recognized members of the Cyber Elite, we work together in partnership to defend our nation’s critical infrastructure while building meaningful and exciting career development opportunities in a culture tailored to the individuals technical and professional growth. We are committed to the belief that our team members do their best work when they are happy and well cared for. In support of this philosophy, we offer a comprehensive benefits package, including major carriers for health care providers. Highlighted benefits offered: 18 days of PTO, 11 holidays, 85% of insurance premium covered, 401k, continued education, certifications maintenance and reimbursement and more.

Who we’re looking for:

We are looking for a Elasticsearch (Elastic/ELK/ECE) Engineer to join our dynamic, fast-paced team within the public sector. The ideal candidate will not only bring technical expertise but also a passion for learning and growth. The Elasticsearch (Elastic/ELK/ECE) Engineer will have exposure to all facets of Systems Engineering and be encouraged to continuously expand your skill set as the company evolves. This is a unique opportunity to play a key role in a fast-growing company at the forefront of the cybersecurity market.

What you’ll be doing:

Lead and support SIEM migration activities, including transitioning customers from ArcSight to the Elastic Stack.

Implement, configure, and document four Elasticsearch clusters in support of enterprise SIEM and analytics requirements.

Develop detailed installation, configuration, and operational documentation to support deployment and sustainment.

Design and implement data pipelines to support log ingestion, normalization, enrichment, and analytics.

Support SIEM development activities, including migration execution, validation, and reporting.

Collaborate with the Integration and Architecture teams to design, document, build, secure and maintain Elasticsearch, Logstash, Kibana (and X-Pack) enterprise solutions in both cloud and on-premises environments.

Work closely with architects, engineers and integrators to assess customer requirements and design Elasticsearch Stack solutions that meet data compliance and performance needs.

Follow the development lifecycle processes to transition solutions from Dev to Test to Production environments.

Participate in Agile sprint meetings, share progress and ensure that the development aligns with project and customer requirements.

Serve as a subject matter expert and trusted advisor, providing guidance and best practice recommendations for Elasticsearch deployments.

Configure and maintain Linux-based operating systems (including updates and version upgrades) to support the Elasticsearch platform.

Install, configure and manage Elastic Cloud Enterprise (ECE) solutions, ensuring seamless communication and integration among Elasticsearch components and data sources.

Create detailed installation and configuration documentation to support deployment.

Secure the solution by implementing TLS, certificates, SSO/PIV authentication and encryption technologies.

Collaborate with the data lifecycle management team to ensure optimal data flow and integrity.

Troubleshoot and monitor data flows and the overall health of the Elasticsearch solution to maximize performance and minimize downtime.

Provide regular status updates and analysis of alternatives in daily sprint meetings.

Build and maintain effective working relationships across departments and teams to coordinate work and deliver results on schedule.

Recommend and implement enhancements to optimize business intelligence processes.

What you need to know:

Experience in software development using Java with an IDE (e.g., Eclipse, CodeReady).

Proficiency in parsing file formats (e.g., JSON, XML, CSV).

Knowledge of SQL Server database design, programming, tuning and writing SQL queries/procedures.

Experience in developing/automating test procedures.

Familiarity with REST API web services client development.

Experience with release management, build tools (e.g., Maven, Jenkins) and configuration tools (e.g., SVN).

Understanding of secure coding practices, including encryption (e.g., certificates, TLS connections).

Must have’s:

Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Mathematics, Engineering or a related field or relevant experience in lieu of degree.

2+ years of relevant experience.

CompTIA Security + certification.

Proven ability to analyze complex requirements and translate them into clear, actionable tasks and processes through critical thinking.

Applicants must hold and maintain an active Secret clearance.

Beneficial to have:

Experience with SAML authentication and familiarity with domain structures, user authentication and PKI.

Experience with Messaging Queues (e.g., RabbitMQ).

Knowledge of Microsoft SQL.

Experience with programming and regular expressions (XML, Java, JSON, Python, PowerShell, Painless, Grok).

Relevant security certifications such as CISSP, CISM, CISA, Security+ or CEH.

Understanding of the relationship between critical infrastructure protection and cybersecurity.

Knowledge and experience with Assessment & Authorization (A&A) processes in federal environments, including familiarity with the NIST Risk Management Framework (RMF).

Where it’s done:

On-site (Schriever SFB - Colorado Springs, CO).