Cyber Systems Engineer - level 5

Northrop Grumman’s Space Sector is seeking a Cyber Systems Engineer -Level 5 to join our team in Colorado Springs, CO.       
 

This position will be based at our Colorado Springs airport facility.

• Lead the design, deployment, configuration, and lifecycle management of Elastic Stack components, including Elasticsearch, Logstash, Kibana, and Elastic Agent/Fleet/Defend in a primarily Linux-based environment.
• Design and implement highly available, scalable, and secure Elastic Stack architectures across distributed and clustered environments.
• Own version upgrades, patching, backup/restore strategies, and capacity planning for Elastic clusters.

• Develop automation for Elastic Stack deployments and configuration management using scripting and/or infrastructure-as-code tools (e.g., Bash, Python, PowerShell, Ansible, Terraform, or equivalent).
• Create reusable playbooks/scripts for provisioning new environments, onboarding new data sources, and performing configuration changes at scale.
• Implement CI/CD-oriented approaches for safely deploying Elastic configuration, ingest pipelines, and detection logic.

• Define and enforce logging best practices for Linux, Windows, network, and security devices to ensure high-fidelity, actionable telemetry.
• Design, implement, and optimize Logstash pipelines and/or Elasticsearch ingest pipelines to onboard logs from diverse sources, including:
  • • System logs (e.g., syslog)
    • Application logs
    • Network and security device logs
    • Metrics and SNMP traps from infrastructure and security tools
• Normalize, enrich, and parse data (including use of regular expressions, grok, dissect, and ECS mapping) to support threat detection, hunting, and reporting use cases.

• Integrate system and application metrics and SNMP traps into Elastic via Logstash and/or ingest pipelines.
• Develop and maintain pipelines to transform metrics and SNMP events into structured documents suitable for dashboards, alerting, and long-term analysis.
• Tune ingestion and storage strategies for performance, cost-efficiency, and retention requirements.

• Develop and implement Complex Elastic queries to extract, analyze, and visualize security data from diverse sources.
• Use Elastic search languages (KQL, ES|QL, Lucene, JQL, etc.) to support threat hunting, incident analysis, and operational monitoring.
• Build and maintain Kibana dashboards, visualizations, and reports tailored to SOC analysts, incident responders, engineering teams, leadership, and auditors.
• Leverage Elastic Defend to create and tune security use cases, correlation rules, and alerts to detect suspicious or malicious activity.

• Monitor the health and performance of the Elastic environment; troubleshoot issues related to data ingestion, indexing, and search performance.
• Support security incident investigations by rapidly querying Elastic data, pivoting across datasets, and providing forensic-quality evidence.
• Collaborate with cross-functional teams (IT, network, application owners, and security operations) to onboard new data sources, implement logging requirements, and improve overall visibility.
• Document Elastic configurations, logging standards, ingest pipelines, operational procedures, and detection logic. Provide clear technical documentation and briefings to both technical and non-technical stakeholders.

• Bachelor’s degree in a STEM field with 12 years of professional experience – OR – Master’s degree with 10 years of professional experience – OR – PhD with 8 years of professional experience
• Must possess an active US Government Top Secret/SCI security clearance
• Must possess, or be able to obtain within two (2) months of start, a DoD 8570 IAT Level II (or higher) certification (e.g., Security+ CE, CCNA-Security, GSEC, etc.).
• Hands-on experience architecting, deploying, and maintaining Elastic Stack (Elasticsearch, Logstash, Kibana, Elastic Agent/Fleet/Defend) in a production environment,
  or similar experience performing advanced SIEM engineering duties in another enterprise SIEM platform such as Splunk or LogRhythm.
• Proven experience designing and managing log and metric ingestion pipelines (Logstash and/or ingest pipelines) in a primarily Linux-based environment,
  or equivalent experience building and managing ingestion and parsing pipelines within another SIEM (e.g., Splunk, LogRhythm).
• Demonstrated experience implementing logging best practices, including source configuration, normalization, and enrichment to support security monitoring and incident response.
• Proficiency in building Kibana dashboards, visualizations, and complex queries using Elastic search languages (e.g., KQL, ES|QL, Lucene),
  or comparable experience creating dashboards, visualizations, and complex searches in other SIEM tools (e.g., Splunk SPL, LogRhythm search languages).
• Experience troubleshooting issues related to data ingestion, indexing, and search performance in Elastic,
  or similar troubleshooting experience in another large-scale SIEM platform.
• Strong background in Linux and solid working knowledge of Windows operating systems and applications.
• Excellent analytical, problem-solving, and troubleshooting skills, with the ability to work independently and in a collaborative team environment.

• US Government 8570 IAT Level III certification.
• Elastic-specific or equivalent SIEM engineering certifications, such as:
  • Elastic Certified Engineer
  • Elastic Certified Analyst
  • Elastic Certified Observability Engineer
  • Splunk Enterprise Certified Architect / Splunk Certified Engineer (or equivalent advanced Splunk certification)
  • Comparable advanced certifications for other SIEM platforms (e.g., LogRhythm Certified Professional/Engineer).
• Experience designing and operating distributed and clustered Elastic environments at scale,
  or equivalent experience scaling and operating other enterprise SIEM platforms (e.g., Splunk, LogRhythm).
• Demonstrated experience integrating metrics and SNMP traps into Elastic via Logstash and/or ingest pipelines,
  or similar integrations of metrics/SNMP traps into other SIEM tools.
• Strong scripting skills with Python, Bash, PowerShell, or similar languages for automation, tooling, and data manipulation.
• Experience implementing infrastructure-as-code approaches (e.g., Ansible, Terraform, or similar tools) for Elastic Stack deployments and configuration management.
• Hands-on experience with:
  • Syslog daemons (e.g., syslogd, rsyslog, syslog-ng)
  • Network security devices (routers, switches, firewalls, NAC, and related solutions)
• Experience in a SOC, CSOC, or Cyber Defense environment supporting incident response, threat hunting, or detection engineering.
• Proven ability to communicate clearly, both verbally and in writing, and to produce high-quality documentation and briefings.

https://www.northropgrumman.com/space

Working at Northrop Grumman is more than just a paycheck. We offer a comprehensive Total Rewards and benefits package designed to help you thrive at work and in life. For more information on our Total Rewards package, please visit our Total Rewards site.

Northrop Grumman Total Rewards