Senior Elastic Stack Data Integration Engineer (Redstone Arsenal)

Huntsville, AL

Full Time

Experienced

Location: Redstone Arsenal, Huntsville, AL
Clearance Required: Active DoD Secret Security Clearance
Travel Required: Up to 10%

LaunchTech is a veteran-owned company that prides itself on delivering service before self and excellence in all we do. We are seeking dynamic professionals who embody our core values of Integrity, Commitment, and Excellence to join our growing Crew in support of our customers across the federal, state, and commercial markets.

We are seeking a Senior Elastic Stack Data Integration Engineer to support the Missile Defense Agency (MDA) on the Integrated Research and Development for Enterprise Solutions (IRES) contract.

What You’ll Be Doing

The Senior Elastic Stack Data Integration Engineer will serve as the primary technical authority for designing, building, and maintaining data ingestion pipelines supporting Elastic SIEM. This role focuses on creating scalable, resilient Logstash architectures; developing advanced pipeline logic; normalizing, enriching, and transforming security telemetry; and ensuring reliable delivery of high-fidelity data to Elasticsearch.

Key Responsibilities:

Architect, build, and maintain Logstash pipelines to ingest and transform logs from diverse systems, including network devices, servers, cloud services, and security platforms.
Implement parsing, grok patterns, JSON transformations, conditional routing, enrichment logic, and ECS mapping.
Optimize pipeline performance, resiliency, and scalability (e.g., persistent queues, pipeline workers, memory tuning, load balancing).
Ensure all ingested data aligns to ECS (Elastic Common Schema) or internal schema requirements.
Implement data enrichment workflows (GeoIP, threat intel lookups, metadata injection).
Validate data completeness, integrity, and fidelity across ingestion flows.
Maintain and optimize Logstash clusters, including version management, scaling, tuning, and high-availability configurations.
Manage integrations with Beats, Elastic Agent, Kafka, syslog endpoints, and custom data collectors.
Monitor ingestion throughput, latency, and error rates; implement proactive alerting and troubleshooting processes.
Create and maintain technical documentation, including pipeline diagrams, data flow maps, runbooks, and schema references.
Establish enterprise standards for parsing, enrichment, normalization, and ingestion patterns.
Support internal and external audits by documenting data handling flows and pipeline logic.
Work closely with SIEM integration engineers to align pipelines with customer environments and logging requirements.
Partner with detection engineering teams to ensure data supports analytic coverage and rule development.
Collaborate with infrastructure and platform operations for deployment, scaling, and reliability engineering.

The successful candidate will have:

Demonstrated ability to work independently, drive pipeline architecture decisions, and mentor junior engineers.
Strong documentation, workflow diagramming, and communication skills.
Deep command of Logstash architecture, patterns, and performance optimization.
Mastery of parsing, enrichment, normalization, and ECS alignment.
Strong understanding of network protocols, logging patterns, and telemetry generation from enterprise systems.
Advanced troubleshooting skills across data ingestion, pipeline logic, and Elastic Stack processing layers.
Capability to design scalable, HA ingestion workflows with clear operational boundaries.
Ability to conduct data modeling, schema design, and transformation mapping.
Effective at interfacing with multiple teams, gathering requirements, and aligning pipeline designs with SIEM analytics needs.
Focused on reliability, maintainability, and observability across all pipeline components.
Strong attention to detail and a disciplined approach to documentation, versioning, and configuration management.

What You Bring

Basic Requirements:

Must have 10, or more, years of general (full-time) work experience
- May be reduced with completion of advanced education
Must have 5, or more, years of experience in log ingestion, data engineering, or SIEM pipeline development
Must have 2, or more, years of experience in a lead or senior role, mentoring and guiding other team members
Must have a strong background in Elastic Stack components (Elasticsearch, Kibana, Beats, Elastic Agent)
Must have experience with data ingestion, processing, and enrichment techniques
Must have hands-on experience ingesting, processing, and normalizing diverse log types (Windows events, syslog, firewall logs, cloud telemetry, security tooling)
Must be proficient with Linux administration, system-level debugging, and CLI-based operations
Must have a DoD 8570.01-M IAT Level II certification with Continuing Education (CE) - (CCNA-Security, CySA+, GICSP, GSEC, Security+ CE, CND, SSCP)
Must have an active DoD Secret Security Clearance
Must be able to obtain an active DoD Top Secret Security Clearance

Desired Requirements:

Be an Elastic Certified Engineer or have relevant Elastic Stack certifications
Have strong experience integrating Kafka, Redis, or other message bus technologies into ingestion workflows
Be proficient with scripting in Python, Bash, or PowerShell for automation and data validation
Have experience designing geo-distributed or multi-cluster ingestion architectures
Have knowledge of threat intelligence ingestion, correlation data enrichment, and advanced ECS mapping
Have experience with CI/CD pipelines, GitOps workflows, or Infrastructure-as-Code (Terraform, Ansible)
Be familiar with data quality assurance frameworks and pipeline testing methodologies
Have knowledge of cloud-native logging architectures (AWS Firehose, Azure Event Hub, GCP Logging)

Why LaunchTech?

LaunchTech is built on a single standard: Excellence, Period.
Join a team delivering secure, scalable data ingestion architectures that power mission-critical cyber defense and SIEM operations across the enterprise.

We offer:

Medical, Dental, and Vision coverage
401(k) with company match
Paid Time Off (PTO)
Mission-driven work with opportunities to grow
And more

Ready to Join the LaunchTech Crew?

LaunchTech is an Equal Opportunity Employer. We prohibit discrimination and harassment of any kind. All qualified applicants will receive consideration for employment without regard to race, protected veteran status, color, sex, religion, sexual orientation, national origin, disability, genetic information, age, pregnancy, or any other status protected under federal, state, or local law.

Visit www.welaunchtech.com to learn more about how we deliver Excellence, Period.

Apply for this position

Required*

First Name*

Last Name*

Email Address*

Phone*

Address

Resume*

We've received your resume. Click here to update it.

Attach resume or Paste resume

Attach resume as .pdf, .doc, .docx, .odt, .txt, or .rtf (limit 5MB) or Paste resume

Paste your resume here or Attach resume file

Do you currently hold an Active DoD Secret Clearance or higher?*

Please list your desired annual salary*

This position is 100% ONSITE. Are you currently located in and within a reasonable commuting distance to Huntsville, AL?*

Do you have at least 5 years of experience in log ingestion, data engineering, or SIEM pipeline development?*

Do you have hands-on experience building or managing Logstash pipelines and Elastic Stack components (Elasticsearch, Kibana, Beats, Elastic Agent)?*

Do you have experience ingesting and normalizing diverse log types such as Windows events, syslog, firewall logs, cloud telemetry, or security tooling logs?*

Do you have experience performing parsing, enrichment, or transformation of log data using techniques such as grok patterns, JSON transformations, or ECS mapping?*

Do you currently hold a DoD 8570.01-M IAT Level II certification (Security+ CE, CySA+, SSCP, etc.)?*

Are you proficient administering Linux systems and performing troubleshooting using command-line tools?*

Do you have experience mentoring engineers or serving in a senior/lead role supporting SIEM or data ingestion pipelines?*

The following questions are entirely optional.

Invitation for Job Applicants to Self-Identify as a U.S. Veteran

A “disabled veteran” is one of the following:
- a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or
- a person who was discharged or released from active duty because of a service-connected disability.
A “recently separated veteran” means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.
An “active duty wartime or campaign badge veteran” means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.
An “Armed forces service medal veteran” means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.

Veteran status

I IDENTIFY AS ONE OR MORE OF THE CLASSIFICATIONS OF PROTECTED VETERAN LISTED ABOVE
I AM NOT A PROTECTED VETERAN
I DON’T WISH TO ANSWER

Voluntary Self-Identification of Disability

Voluntary Self-Identification of Disability Form CC-305
OMB Control Number 1250-0005
Expires 04/30/2026

Why are you being asked to complete this form?

We are a federal contractor or subcontractor. The law requires us to provide equal employment opportunity to qualified people with disabilities. We have a goal of having at least 7% of our workers as people with disabilities. The law says we must measure our progress towards this goal. To do this, we must ask applicants and employees if they have a disability or have ever had one. People can become disabled, so we need to ask this question at least every five years.

Completing this form is voluntary, and we hope that you will choose to do so. Your answer is confidential. No one who makes hiring decisions will see it. Your decision to complete the form and your answer will not harm you in any way. If you want to learn more about the law or this form, visit the U.S. Department of Labor’s Office of Federal Contract Compliance Programs (OFCCP) website at www.dol.gov/ofccp.

How do you know if you have a disability?

A disability is a condition that substantially limits one or more of your “major life activities.” If you have or have ever had such a condition, you are a person with a disability. Disabilities include, but are not limited to:

Alcohol or other substance use disorder (not currently using drugs illegally)
Autoimmune disorder, for example, lupus, fibromyalgia, rheumatoid arthritis, HIV/AIDS
Blind or low vision
Cancer (past or present)
Cardiovascular or heart disease
Celiac disease
Cerebral palsy
Deaf or serious difficulty hearing
Diabetes
Disfigurement, for example, disfigurement caused by burns, wounds, accidents, or congenital disorders
Epilepsy or other seizure disorder
Gastrointestinal disorders, for example, Crohn's Disease, irritable bowel syndrome
Intellectual or developmental disability
Mental health conditions, for example, depression, bipolar disorder, anxiety disorder, schizophrenia, PTSD
Missing limbs or partially missing limbs
Mobility impairment, benefiting from the use of a wheelchair, scooter, walker, leg brace(s) and/or other supports
Nervous system condition, for example, migraine headaches, Parkinson’s disease, multiple sclerosis (MS)
Neurodivergence, for example, attention-deficit/hyperactivity disorder (ADHD), autism spectrum disorder, dyslexia, dyspraxia, other learning disabilities
Partial or complete paralysis (any cause)
Pulmonary or respiratory conditions, for example, tuberculosis, asthma, emphysema
Short stature (dwarfism)
Traumatic brain injury

Please check one of the boxes below:

YES, I HAVE A DISABILITY, OR HAVE HAD ONE IN THE PAST NO, I DO NOT HAVE A DISABILITY AND HAVE NOT HAD ONE IN THE PAST I DO NOT WANT TO ANSWER

PUBLIC BURDEN STATEMENT: According to the Paperwork Reduction Act of 1995 no persons are required to respond to a collection of information unless such collection displays a valid OMB control number. This survey should take about 5 minutes to complete.

You must enter your name and date
Name	Date

Human Check*

Submit Application