SIEM Architect

TIAG is now hiring a SIEM Architect to support a modernization and transition initiative for a Uniformed Services University (USU) enclave. This position is based on at the customer site in Bethesda, MD in a hybrid capacity.

This role directly supports SIEM Modernization and Cloud Transition at USU. As the technical lead, the SIEM Architect will guide a team of two Information Systems Security Engineers (ISSEs) to enable and oversee the transition of approximately 150 on-premise and cloud-hosted servers from a current Splunk Enterprise environment to a modern, Government-selected cloud-native SIEM platform. While Government-Furnished Labor (GFL) primarily performs server-level implementation, the Architect will oversee the end-to-end implementation process, provide deep technical enablement, and actively assist with hands-on implementation where needed to ensure project success.

Primary Responsibilities

• Enable and oversee the implementation and transition of 150+ enterprise assets into the selected cloud-native SIEM environment.
• Assist with hands-on server-level implementation, integration, and telemetry configuration where needed to bridge capability gaps and ensure project momentum.
• Provide architectural vision and daily technical direction to two dedicated Information Systems Security Engineers (ISSEs) supporting the transition effort.
• Serve as the primary technical escalation point for complex interoperability issues, delegating routine telemetry validation and parser configuration tasks to the ISSE team.
• Lead the collaborative assessment of the current USU Splunk Enterprise environment, directing the ISSE team to document onboarded log sources, telemetry coverage, ingestion methods, and parser configurations.
• Evaluate Government-Furnished Enterprise (GFE) SIEM platforms (Splunk Cloud, Microsoft Sentinel, Google Chronicle) against the enclave's operational, security, and modernization requirements.
• Deliver a Platform Evaluation & Selection Report containing the formal technical recommendation for the platform best aligned with USU goals.
• Develop a Security Configuration Baseline for the chosen SIEM solution that aligns with DoD cybersecurity requirements, DISA STIG guidance, RMF controls, and Zero Trust principles.
• Establish enterprise-wide Logging Standards by analyzing operating system environments across the enclave.
• Define comprehensive requirements for telemetry collection, event categorization, normalization, and retention in a finalized Logging Standards Manual.
• Architect and build Reference Implementations for all supported OS categories, utilizing templates, scripts, Group Policy Objects (GPOs), and agent profiles.
• Govern the ongoing transition of the 150+ enterprise assets, ensuring the ISSEs effectively deliver day-to-day Tier 2 technical support to GFL administrators for ingestion failures, parser inconsistencies, and connectivity issues.
• Validate the telemetry pipelines established during implementation, ensuring the representative servers ("proving the pipe") demonstrate successful end-to-end event generation, ingestion, parsing, normalization, and visibility.
• Oversee technical troubleshooting workflows, root cause analysis, and operational status reporting throughout the implementation lifecycle.
• Design the operational governance framework for the future-state cloud-native monitoring environment.
• Direct the ISSE team in authoring practical Standard Operating Procedures (SOPs) for Tier 1 GFL administrators.
• Develop standardized methodologies for alert tuning, threshold tuning, suppression management, and false-positive handling to improve SOC efficiency.
• Assess existing GFL cloud operations knowledge to design targeted "delta" training focused strictly on the unique features of the newly implemented SIEM solution.
• Lead high-level instructional sessions on platform-specific querying (e.g., KQL for Microsoft Sentinel or UDM for Google Chronicle), while utilizing the ISSEs to facilitate hands-on labs.
• Certify operational readiness by verifying that GFL personnel can independently sustain day-to-day SIEM operations post-implementation.

Qualifications

Required Experience:

• 8-10+ years of overall cybersecurity and IT experience, with at least 5 years serving as a SIEM Architect, Senior Engineer, or technical implementation lead.
• Demonstrated architectural and implementation expertise in deploying and optimizing Splunk Enterprise, Splunk Cloud, Microsoft Sentinel, and Google Chronicle.
• Proven ability to lead a technical team (e.g., ISSEs, SOC analysts) while overseeing and assisting with large-scale log onboarding and transition projects.
• Deep understanding of Federal and DoD compliance frameworks, including DISA STIGs, Risk Management Framework (RMF), and Zero Trust principles.
• Proficiency in scripting and configuration management tools to design and deploy reusable implementation artifacts (GPOs, agent profiles).
• Strong technical writing skills to produce comprehensive governance documentation, Logging Standards Manuals, and operational SOPs.
• Ability to facilitate technical workshops, present comparative analyses to executive stakeholders, and deliver hands-on technical training to operations personnel.
• Secret Clearance
• CompTIA Security+ Certification

TIAG is an equal opportunity employer and federal contractor or subcontractor. Consequently, the parties agree that, as applicable, they will abide by the requirements of 41 CFR 60-1.4(a), 41 CFR 60-300.5(a), and 41 CFR 60-741.5(a) and employment decisions shall be based solely on merit and without regard disability, or protected veteran status, or any other characteristic protected by local, state, or federal laws, rules, or regulations. TIAG takes proactive steps to employ and advance in employment qualified individuals without regard to disability or protected veteran status. The parties also agree that, as applicable, they will abide by the requirements and may be subject and required to take action pursuant to the following laws and accompanying regulations:

The Vietnam Era Veterans Readjustment Assistance Act of 1974, as amended (and its implementing regulations at 41 C.F.R. 60-300);
Section 503 of the Rehabilitation Act of 1973, as amended (and its implementing regulations at 41 C.F.R 60-741); and
Executive Order 13496 (and its implementing regulations at 29 C.F.R. part 471, Appendix A to Subpart A).