Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowFirst seen 4 days ago

Sr. SIEM Engineering Consultant

ECS FEDERAL LLC255 open roles

Pay
$140,000 – $180,000 a year
Where
Work from home, VA, USA
Work mode
Remote
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSr. SIEM Engineering ConsultantECS FEDERAL LLC · Work from home, VA, USA

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on ECS FEDERAL LLC's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.3% of postings close within 7 days. Measured by our own scanner across the market. ECS FEDERAL LLC postings stay open a median of 2 days.

Share of postings closed within
  1. 2.1%1 day
  2. 4.5%3 days
  3. 12.3%7 days
  4. 19.3%14 days
  5. 35.6%30 days
  6. 57.8%60 days
This job: first seen 4 days ago

ECS FEDERAL LLC median: 2 days open

The posting

Everforth ECS is seeking a Sr. SIEM Engineering Consultant to join our team remotely. This position is contingent upon contract award.

Are you passionate about building and scaling cloud-native SIEM solutions and eager to make an immediate technical impact? Join ECS, a leading provider of cloud, AI, data, and enterprise transformation solutions. In this role, you will implement, optimize, and maintain Microsoft Sentinel environments at scale while contributing to architecture, automation, and integrations that improve security visibility, detection, and operational efficiency.

We are seeking a Sr. SIEM Engineering Consultant to join our Managed Security Services (MSSP) team. The ideal candidate has hands-on experience with Microsoft Sentinel and enjoys designing, coding, and deploying complex security monitoring and detection solutions. You will collaborate with engineering, DevOps, cloud, and client teams to deliver resilient, high-performance SIEM capabilities while maintaining visibility into threats, system health, and operational workflows.

Key Responsibilities:

  • Design, deploy, and maintain Microsoft Sentinel environments, including Log Analytics Workspaces and data connectors.
  • Build and optimize data ingestion pipelines, detection rules (analytics), queries (KQL), dashboards (Workbooks), and automation workflows.
  • Write scripts, automation, and integrations (Python, PowerShell, Bash, etc.) to streamline security operations, data processing, and monitoring.
  • Deploy and manage Sentinel across cloud environments, primarily Azure, with integrations into AWS, GCP, and hybrid/on-premises environments.
  • Leverage automation and orchestration tools such as Terraform, Ansible, CI/CD pipelines, and infrastructure-as-code to manage deployments and operational tasks.
  • Integrate Sentinel with enterprise tools such as Microsoft Defender, identity providers, firewalls, EDR platforms, and other telemetry sources.
  • Monitor system health, troubleshoot ingestion and performance issues, and optimize for cost, reliability, and scalability.
  • Develop and tune detection use cases aligned to threat frameworks (e.g., MITRE ATT&CK).
  • Configure incident management, alert grouping, and response workflows within Sentinel.
  • Implement automation and response using playbooks (Logic Apps) for alert enrichment and remediation.
  • Lead design reviews, provide guidance on SIEM best practices, and support knowledge sharing across teams.
  • Maintain documentation for architectures, detection logic, deployment patterns, runbooks, and operational best practices.
  • Stay current with Microsoft security technologies, Sentinel features, and emerging SIEM capabilities.

Salary Range: $140,000 - $180,000

General Description of Benefits

  • Deep, hands-on expertise with Microsoft Sentinel and Azure Monitor (Log Analytics, KQL, data connectors).
  • Strong experience with SIEM engineering, including log ingestion, normalization, detection engineering, and incident response workflows.
  • Proficiency in Kusto Query Language (KQL) for detection development and data analysis.
  • Strong scripting and automation skills (Python, PowerShell, Bash, etc.).
  • Solid understanding of security operations, threat detection, and observability in distributed systems.
  • Experience designing, deploying, and optimizing production-scale SIEM environments.
  • Strong knowledge of Azure, cloud security architecture, networking, and identity systems.
  • Ability to mentor, guide, and influence engineering teams on SIEM and security best practices.
  • Outstanding verbal and written communication skills.
  • Willingness and ability to support domestic or international on-site engagements.
  • U.S. Passport required.
  • Must be eligible to obtain a U.S. Security Clearance.
From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against ECS FEDERAL LLC's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on ECS FEDERAL LLC's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    ECS FEDERAL LLC's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.