Computer Application and Engineering (SIEM) Developer

Peraton is seeking to hire an experienced Computer Application and Engineering (SIEM) Developer for its' Regional Cyber Center-Europe program. 

Location: Wiesbaden, Germany 

Potentially 2nd/3rd Shift work 

Responsibilities:

• Develop, maintain, and optimize SIEM platforms (Elastic Stack and/or Splunk) that process approximately 3.6 billion security events per day across USAREUR-AF networks, ensuring platform stability and detection effectiveness
• Design and manage log normalization pipelines using Kafka and Logstash to ingest, parse, and enrich disparate log sources from firewalls, endpoints, DNS, proxies, and cloud environments into a unified data schema
• Build and maintain event correlation dashboards and visualizations in Kibana or Splunk that provide real-time situational awareness for CSSP analysts and leadership
• Administer and maintain approximately 120 Red Hat Enterprise Linux servers supporting CSSP SIEM infrastructure, performing patching, performance tuning, capacity planning, and configuration management
• Develop and maintain detection content including correlation rules, alerts, and saved searches that translate threat intelligence and analyst requirements into automated detection logic
• Sustain 99% or greater platform uptime SLA for all security monitoring systems through proactive monitoring, incident response, and continuous improvement of SIEM architecture and supporting infrastructure

#RCC-E

Required:

• Minimum of 5 years of SIEM development and maintenance experience, including 2 years experience on UNIX/Linux platforms, with a Bachelor’s degree in a STEM field or Business Administration; 11 years of relevant experience may substitute for degree
• Must meet TESA Qualifications. 
• DoD 8140 - IT (System Administrator) - Advanced
• Certifications — must hold active certifications (one of the following):
  • GDSA (GIAC Defensible Security Architecture); OR
  • Elastic Certified Engineer or Architect; OR
  • Splunk Enterprise Certified Admin; OR
  • Splunk Enterprise Certified Architect; OR
  • Microsoft Certified: Cybersecurity Architect Expert; OR
  • ArcSight Enterprise Security Manager Advanced Administrator Certified Expert
• U.S. citizenship required
• Active DoD TS/SCI clearance

Preferred:

• Deep expertise with Elastic Stack (Elasticsearch, Logstash, Kibana, Beats, Fleet) for large-scale SIEM deployment and administration
• Advanced Splunk administration skills including index management, search head clustering, and forwarder deployment
• Experience with Apache Kafka for high-throughput log streaming and pipeline architecture
• Proficiency with Logstash and custom filter development for multi-source log normalization
• Strong Linux systems administration skills (RHEL/CentOS) for managing large server fleets
• Python scripting experience for SIEM automation, API integrations, and custom data processing
• Familiarity with Kibana dashboard development and Elastic detection rule authoring (EQL, KQL)
• Experience with ArcSight ESM administration and content development in enterprise DoD environments