Apply Now

SIEM Administrator/Engineer

Washington, DC, US • Posted 19 hours ago • Updated 19 hours ago

Full Time

On-site

USD $80,001.00 - 120,000.00 per year

SAIC

Fitment

Dice Job Match Score™

🔢 Crunching numbers...

Job Details

Skills

Security Clearance
Critical Thinking
Use Cases
Management
Network
Database
Cloud Computing
Storage
Technical Writing
Computer Science
Information Systems
SPL
Dashboard
Onboarding
SQL
Reporting
Normalization
Command-line Interface
Microsoft Windows
Linux
Computer Networking
TCP/IP
Dragon NaturallySpeaking
DNS
HTTP
HTTPS
TLS
Cyber Security
Firewall
IDS
IPS
Vulnerability Management
Data Quality
ROOT
Accountability
Communication
Collaboration
Kibana
DSL
Analytics
SIEM
Migration
Elasticsearch
Scripting
Python
Windows PowerShell
Bash
Security Operations
System On A Chip
Splunk
Security+
GSEC
Information Technology
Systems Engineering
FOCUS

Security Clearance
Critical Thinking
Use Cases
Management
Network
Database
Cloud Computing
Storage
Technical Writing
Computer Science
Information Systems
SPL
Dashboard
Onboarding
SQL
Reporting
Normalization
Command-line Interface
Microsoft Windows
Linux
Computer Networking
TCP/IP
Dragon NaturallySpeaking
DNS
HTTP
HTTPS
TLS
Cyber Security
Firewall
IDS
IPS
Vulnerability Management
Data Quality
ROOT
Accountability
Communication
Collaboration
Kibana
DSL
Analytics
SIEM
Migration
Elasticsearch
Scripting
Python
Windows PowerShell
Bash
Security Operations
System On A Chip
Splunk
Security+
GSEC
Information Technology
Systems Engineering
FOCUS

Summary

Job ID: 2616042

Location: Washington, DC, US

Date Posted: 2026-08-24

Category: Cyber

Subcategory: Cybersecurity Spec

Schedule: Full-Time

Shift: Day Job

Travel: No

Minimum Clearance Required: None

Clearance Level Must Be Able to Obtain: Public Trust

Potential for Remote Work: ORA_HYBRID

Description

SAIC is seeking a SIEM Administrator / Engineer to support enterprise cybersecurity operations and the modernization of the agency's security monitoring and analytics capabilities. This position will provide hands-on administration of the organization's existing Splunk environment while helping transition security monitoring, log analytics, and detection capabilities to Elastic / Elastic Security.

The ideal candidate has strong hands-on SIEM administration experience and is ready to grow into a broader engineering role. The successful candidate should be able to independently administer and troubleshoot production SIEM and logging infrastructure while demonstrating the technical curiosity, critical thinking, ownership, and initiative necessary to solve problems and improve the environment.

***This hybrid role requires a minimum of three on-site days per week in Washington, DC.***

Responsibilities

Administer, maintain, monitor, and troubleshoot the existing Splunk Enterprise / Splunk ES environment while supporting the implementation and operationalization of Elastic / Elastic Security.
Support the organization's transition from Splunk to Elastic, including migration and validation of data sources, searches, dashboards, reports, alerts, and security use cases.
Configure, manage, and troubleshoot enterprise log ingestion pipelines, including syslog, Windows Event Collection/Forwarding, Splunk forwarders, Elastic agents, network and security devices, applications, databases, cloud services, and APIs.
Onboard new data sources and ensure telemetry is reliably collected, parsed, normalized, enriched, indexed, and searchable using applicable standards such as Splunk CIM and Elastic Common Schema (ECS).
Troubleshoot logging and telemetry issues across the complete data path, from the originating system through collection, transport, ingestion, indexing, and search.
Develop, maintain, and optimize SIEM searches, dashboards, reports, alerts, and security detections using SPL and Elastic query technologies, including KQL, ES|QL, EQL, and Query DSL as applicable.
Use SQL and other query languages to analyze data, validate results, troubleshoot integrations, and support cybersecurity investigations and reporting.
Monitor and optimize SIEM platform health, performance, storage, ingestion, retention, and capacity.
Work with security analysts and cybersecurity engineers to develop, test, tune, and improve security monitoring and detection capabilities.
Investigate technical problems, test hypotheses, identify root causes, and implement or recommend practical solutions.
Use scripting, APIs, and automation where appropriate to improve SIEM administration, monitoring, data onboarding, and repetitive operational processes.
Maintain technical documentation and take ownership of assigned technical issues and projects through resolution.

Qualifications

Requirements

Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical discipline (4 years experience in lieu of degree)
5+ years experience relevant IT/cybersecurity experience.
Ability to obtain and maintain a public trust requiring U.S. Citizenship or
3+ years of hands-on SIEM administration experience supporting enterprise or similarly complex environments.
Hands-on experience with Splunk Enterprise, including SPL, data ingestion, forwarders, indexes, searches, dashboards, alerts, and platform troubleshooting.
Experience onboarding and troubleshooting enterprise log sources and understanding telemetry flow from source systems through collection, ingestion, indexing, and search.
Working knowledge of SQL and experience querying data for analysis, troubleshooting, validation, or reporting.
Experience with or working knowledge of Elastic, Elasticsearch, Kibana, or comparable search and analytics technologies, with the ability to rapidly develop deeper Elastic expertise.
Understanding of enterprise logging concepts, including collection, parsing, normalization, enrichment, indexing, retention, and data quality.
Strong Linux command-line skills and working knowledge of Windows/Linux systems, networking, and common protocols such as TCP/IP, DNS, HTTP/HTTPS, TLS, and syslog.
Familiarity with enterprise cybersecurity technologies such as EDR, firewalls, IDS/IPS, identity systems, and vulnerability management platforms.
Demonstrated ability to independently troubleshoot technical problems, analyze unfamiliar data, test assumptions, identify root causes, and develop practical solutions.
Strong technical curiosity, ownership, accountability, and ability to learn new technologies, platforms, and query languages.
Strong written and verbal communication skills with the ability to document technical processes and collaborate effectively across teams.

Preferred Qualifications

Hands-on experience with Elastic Stack / Elastic Security, including Elasticsearch, Kibana, Elastic Agent/Fleet, Beats, or Logstash.
Experience with KQL, ES|QL, EQL, Query DSL, or comparable search and analytics languages.
Experience supporting a SIEM migration, particularly Splunk-to-Elastic or a comparable enterprise migration.
Experience with Splunk ES, Splunk CIM, Elastic Common Schema (ECS), or distributed Splunk environments.
Experience with security detection engineering, correlation rules, alert tuning, threat hunting, or MITRE ATT&CK.
Experience with scripting or automation using Python, PowerShell, Bash, REST APIs, or similar technologies.
Experience working in or closely supporting a Security Operations Center (SOC).
Relevant technical certifications such as Splunk, Elastic, Security+, CySA+, GSEC, or comparable certifications.

Target salary range: $80,001 - $120,000. The estimate displayed represents the typical salary range for this position based on experience and other factors.

Employers have access to artificial intelligence language tools (“AI”) that help generate and enhance job descriptions and AI may have been used to create this description. The position description has been reviewed for accuracy and Dice believes it to correctly reflect the job opportunity.

Dice Id: 10111346
Position Id: 2616042
Posted 19 hours ago

Company Info

About SAIC

SAIC® is a premier mission integrator focused on advancing the power of technology and innovation to serve and protect our world. Our robust portfolio of offerings across the defense, space, intelligence, and civilian markets includes secure high-end solutions in mission IT, enterprise IT, engineering services, and professional services. We integrate emerging technology, rapidly and securely, into mission critical operations that modernize and enable critical national imperatives.

We are approximately 23,000 strong; driven by mission, united by purpose, and inspired by opportunities. Headquartered in Reston, Virginia, SAIC has annual revenues of approximately $7.3 billion. For more information, visit saic.com. For ongoing news, please visit our newsroom.

Go to company profile

Create job alert

Never miss an opportunity! Create an alert based on the job you applied for.

Similar Jobs

Systems Engineer Manager

Springfield, Virginia

•

Today

Job ID: 2615710 Location: Springfield, VA, US Date Posted: 2026-08-15 Category: Engineering and Sciences Subcategory: Systems Engineer Schedule: Full-Time Shift: Day Job Travel: Yes - 10% of the time Minimum Clearance Required: TS.SCI Clearance Level Must Be Able to Obtain: TS/SCI with Poly Potential for Remote Work: ORA_ON_SITE Description SAIC is seeking an executive-level Senior Systems Engineer and Program Management Advisor to join an exciting program in Springfield VA, supporting

Full-time

USD 160,001.00 - 200,000.00 per year

Cyber Defense Analyst

Washington, District of Columbia

•

Today

Job ID: 2615324-OTHLOC-006 Location: Washington, DC, US Date Posted: 2026-08-06 Category: Cyber Subcategory: Cybersecurity Ops Schedule: Full-Time Shift: Day Job Travel: Yes - 10% of the time Minimum Clearance Required: TS.SCI_wPoly Clearance Level Must Be Able to Obtain: None Potential for Remote Work: ORA_ON_SITE Description SAIC is seeking a candidate to fill a Cyber Defense Analyst position on a joint Contractor-Government Cyber Protection Team with our customer at Ft. Meade, MD. J

Full-time

USD 120,001.00 - 160,000.00 per year

ICAM Architect

Springfield, Virginia

•

Today

Job ID: 2614889 Location: Springfield, VA, US Date Posted: 2026-07-23 Category: Information Technology Subcategory: Network Engineer Schedule: Full-Time Shift: Day Job Travel: Yes - 10% of the time Minimum Clearance Required: TS.SCI Clearance Level Must Be Able to Obtain: TS/SCI with Poly Potential for Remote Work: ORA_ON_SITE Description SAIC is seeking a highly skilled and motivated ICAM Architect to design, implement, and optimize advanced Identity, Credential, and Access Management

Full-time

USD 120,001.00 - 160,000.00 per year

Senior Information Systems Security Officer

Washington, District of Columbia

•

Today

Job ID: 2615643 Location: Washington, DC, US Date Posted: 2026-08-13 Category: Cyber Subcategory: Cyber GRC Schedule: Full-Time Shift: Day Job Travel: No Minimum Clearance Required: None Clearance Level Must Be Able to Obtain: Public Trust Potential for Remote Work: ORA_HYBRID Description SAIC is seeking a technical Senior Information System Security Officer (ISSO) to support a critical U.S. government agency in the National Capital Region. This role reports to the Security Program Man

Full-time

USD 120,001.00 - 160,000.00 per year

Search all similar jobs

More jobs at SAIC in Washington, DC