Cybersecurity Data Engineer

Fort Meade, MD (onsite) role supporting operational cybersecurity by building and optimizing Elastic-based data pipelines. This position focuses on high-availability ingestion, storage, retrieval, and scalable ETL workflows that help teams transform security telemetry into dependable analytics and detection inputs.

What you will do

• Configure and optimize data ingestion, storage, and retrieval within the Elastic ecosystem (Elasticsearch, Logstash, Kibana, Fleet) for high-volume, high-availability operations.
• Design, maintain, and optimize scalable cybersecurity ETL pipelines using the Elastic toolset.
• Build transformations and enrichments for diverse security log and telemetry sources.
• Maintain index templates, mappings, schemas, and data models that support analytics and detection logic.
• Implement data validation, deduplication, and quality controls to protect data integrity.
• Automate ingestion, transformation, and engineering workflows using Python, Bash, and related tools.
• Monitor pipeline and indexing performance, troubleshoot data-flow issues, and optimize throughput, storage, and query performance.
• Maintain traceability and troubleshoot dependencies across Kafka, Elastic, and CI/CD tooling.
• Partner with Detection Engineering, Threat Analysis, Endpoint, and other cyber teams to support operational requirements.
• Maintain technical documentation, SOPs, and engineering artifacts for repeatable operations.

What you will bring

• TS clearance.

Tools you will work with

• Elasticsearch, Logstash, Kibana, Fleet (Elastic)
• Python, Bash
• Kafka
• CI/CD
• Ruby
• AWS, Azure, GCP, Oracle Cloud

Nice to have

• Experience with Kafka, Python/Bash automation, CI/CD, or DevSecOps practices.
• Experience working with Ruby.
• Experience supporting AWS, Azure, GCP, Oracle Cloud, hybrid-cloud, or multi-cloud environments.
• Knowledge of cybersecurity operations, including SIEM, threat detection, incident response, and security monitoring.