Cyber Systems Engineer - level 5

• Location: United States-Colorado-Colorado Springs
• RELOCATION ASSISTANCE: No relocation assistance available
• CLEARANCE REQUIRED FOR START: Yes
• CLEARANCE TYPE: Top Secret
• TRAVEL: Yes, 10% of the Time

Description

At Northrop Grumman, our employees have incredible opportunities to work on revolutionary systems that impact people's lives around the world today, and for generations to come. Our pioneering and inventive spirit has enabled us to be at the forefront of many technological advancements in our nation's history - from the first flight across the Atlantic Ocean, to stealth bombers, to landing on the moon. We look for people who have bold new ideas, courage and a pioneering spirit to join forces to invent the future, and have fun along the way.

Our culture thrives on intellectual curiosity, cognitive diversity and bringing your whole self to work — and we have an insatiable drive to do what others think is impossible. Our employees are not only part of history, they're making history.

Northrop Grumman’s Space Sector is seeking a Cyber Systems Engineer -Level 5 to join our team in Colorado Springs, CO.

This position will be based at our Colorado Springs airport facility.

In this position, you will

• Architect, Deploy, and Maintain Elastic Stack
• Lead the design, deployment, configuration, and lifecycle management of Elastic Stack components, including Elasticsearch, Logstash, Kibana, and Elastic Agent/Fleet/Defend in a primarily Linux-based environment.
• Design and implement highly available, scalable, and secure Elastic Stack architectures across distributed and clustered environments.
• Own version upgrades, patching, backup/restore strategies, and capacity planning for Elastic clusters.
• Automation and Infrastructure-as-Code
• Develop automation for Elastic Stack deployments and configuration management using scripting and/or infrastructure-as-code tools (e.g., Bash, Python, PowerShell, Ansible, Terraform, or equivalent).
• Create reusable playbooks/scripts for provisioning new environments, onboarding new data sources, and performing configuration changes at scale.
• Implement CI/CD-oriented approaches for safely deploying Elastic configuration, ingest pipelines, and detection logic.
• Log Ingestion, Pipelines, and Best Practices
• Define and enforce logging best practices for Linux, Windows, network, and security devices to ensure high-fidelity, actionable telemetry.
• Design, implement, and optimize Logstash pipelines and/or Elasticsearch ingest pipelines to onboard logs from diverse sources, including:
• System logs (e.g., syslog)
• Application logs
• Network and security device logs
• Metrics and SNMP traps from infrastructure and security tools
• Normalize, enrich, and parse data (including use of regular expressions, grok, dissect, and ECS mapping) to support threat detection, hunting, and reporting use cases.
• Metrics, Telemetry, and SNMP-Trap Integration
• Integrate system and application metrics and SNMP traps into Elastic via Logstash and/or ingest pipelines.
• Develop and maintain pipelines to transform metrics and SNMP events into structured documents suitable for dashboards, alerting, and long-term analysis.
• Tune ingestion and storage strategies for performance, cost-efficiency, and retention requirements.
• Dashboards, Analytics, and Detection Engineering
• Develop and implement Complex Elastic queries to extract, analyze, and visualize security data from diverse sources.
• Use Elastic search languages (KQL, ES|QL, Lucene, JQL, etc.) to support threat hunting, incident analysis, and operational monitoring.
• Build and maintain Kibana dashboards, visualizations, and reports tailored to SOC analysts, incident responders, engineering teams, leadership, and auditors.
• Leverage Elastic Defend to create and tune security use cases, correlation rules, and alerts to detect suspicious or malicious activity.
• Operations, Incident Support, and Collaboration
• Monitor the health and performance of the Elastic environment; troubleshoot issues related to data ingestion, indexing, and search performance.
• Support security incident investigations by rapidly querying Elastic data, pivoting across datasets, and providing forensic-quality evidence.
• Collaborate with cross-functional teams (IT, network, application owners, and security operations) to onboard new data sources, implement logging requirements, and improve overall visibility.
• Document Elastic configurations, logging standards, ingest pipelines, operational procedures, and detection logic. Provide clear technical documentation and briefings to both technical and non-technical stakeholders.

Basic Qualifications

• Bachelor’s degree in a STEM field with 12 years of professional experience – OR – Master’s degree with 10 years of professional experience – OR – PhD with 8 years of professional experience
• Must possess an active US Government Top Secret/SCI security clearance
• Must possess, or be able to obtain within two (2) months of start, a DoD 8570 IAT Level II (or higher) certification (e.g., Security+ CE, CCNA-Security, GSEC, etc.).
• Hands-on experience architecting, deploying, and maintaining Elastic Stack (Elasticsearch, Logstash, Kibana, Elastic Agent/Fleet/Defend) in a production environment,
• or similar experience performing advanced SIEM engineering duties in another enterprise SIEM platform such as Splunk or LogRhythm.
• Proven experience designing and managing log and metric ingestion pipelines (Logstash and/or ingest pipelines) in a primarily Linux-based environment,
• or equivalent experience building and managing ingestion and parsing pipelines within another SIEM (e.g., Splunk, LogRhythm).
• Demonstrated experience implementing logging best practices, including source configuration, normalization, and enrichment to support security monitoring and incident response.
• Proficiency in building Kibana dashboards, visualizations, and complex queries using Elastic search languages (e.g., KQL, ES|QL, Lucene),
• or comparable experience creating dashboards, visualizations, and complex searches in other SIEM tools (e.g., Splunk SPL, LogRhythm search languages).
• Experience troubleshooting issues related to data ingestion, indexing, and search performance in Elastic,
• or similar troubleshooting experience in another large-scale SIEM platform.
• Strong background in Linux and solid working knowledge of Windows operating systems and applications.
• Excellent analytical, problem-solving, and troubleshooting skills, with the ability to work independently and in a collaborative team environment.

Preferred Qualifications

US Government 8570 IAT Level III certification.

Elastic-specific or equivalent SIEM engineering certifications, such as:

Elastic Certified Engineer

Elastic Certified Analyst

Elastic Certified Observability Engineer

• Splunk Enterprise Certified Architect / Splunk Certified Engineer (or equivalent advanced Splunk certification)
• Comparable advanced certifications for other SIEM platforms (e.g., LogRhythm Certified Professional/Engineer).
• Experience designing and operating distributed and clustered Elastic environments at scale,
• or equivalent experience scaling and operating other enterprise SIEM platforms (e.g., Splunk, LogRhythm).
• Demonstrated experience integrating metrics and SNMP traps into Elastic via Logstash and/or ingest pipelines,
• or similar integrations of metrics/SNMP traps into other SIEM tools.
• Strong scripting skills with Python, Bash, PowerShell, or similar languages for automation, tooling, and data manipulation.
• Experience implementing infrastructure-as-code approaches (e.g., Ansible, Terraform, or similar tools) for Elastic Stack deployments and configuration management.

Hands-on experience with

• Syslog daemons (e.g., syslogd, rsyslog, syslog-ng)
• Network security devices (routers, switches, firewalls, NAC, and related solutions)
• Experience in a SOC, CSOC, or Cyber Defense environment supporting incident response, threat hunting, or detection engineering.
• Proven ability to communicate clearly, both verbally and in writing, and to produce high-quality documentation and briefings.
• Curious about all the exciting developments with the Northrop Grumman Space Sector? Click the link below:
• https://www.northropgrumman.com/space
• Working at Northrop Grumman is more than just a paycheck. We offer a comprehensive Total Rewards and benefits package designed to help you thrive at work and in life. For more information on our Total Rewards package, please visit our Total Rewards site.

Northrop Grumman Total Rewards

#SPEnhancedERAP

Primary Level Salary Range: $177,000.00 - $265,600.00

The above salary range represents a general guideline; however, Northrop Grumman considers a number of factors when determining base salary offers such as the scope and responsibilities of the position and the candidate's experience, education, skills and current market conditions.

Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay. Annual bonuses are designed to reward individual contributions as well as allow employees to share in company results. Employees in Vice President or Director positions may be eligible for Long Term Incentives. In addition, Northrop Grumman provides a variety of benefits including health insurance coverage, life and disability insurance, savings plan, Company paid holidays and paid time off (PTO) for vacation and/or personal business.

The application period for the job is estimated to be 20 days from the job posting date. However, this timeline may be shortened or extended depending on business needs and the availability of qualified candidates.

Northrop Grumman is an Equal Opportunity Employer, making decisions without regard to race, color, religion, creed, sex, sexual orientation, gender identity, marital status, national origin, age, veteran status, disability, or any other protected class. For our complete EEO and pay transparency statement, please visit http://www.northropgrumman.com/EEO. U.S. Citizenship is required for all positions with a government clearance and certain other restricted positions.