This role pays less than
74%
of similar roles. Most pay
$142,187–$224,625
— the shaded band above.
At the midpoint, this role pays about
$142k
versus about
$183k
for comparable roles.
Based on 240 similar postings.
Employer
About Booz Allen Hamilton
Booz Allen Hamilton is a management and technology consulting firm that provides analytics, digital, engineering, and cybersecurity solutions primarily to U.S. government agencies and commercial clients. Industry: Management & Technology Consulting
Booz Allen Hamilton currently has
802 open roles
on FindRole.
Listed pay typically runs
$86,800–$198,000
across 783 roles with salary data.
The mid-level Cribl Engineer joins the Visibility Analytics and Automation Team to build, manage, and optimize enterprise data pipelines feeding a downstream SIEM ecosystem. The role involves designing routing, filtering, and transformation logic using Cribl Stream and Cribl Edge while normalizing log sources to standardized schemas like CIM and ECS. Daily responsibilities include implementing complex masking, enrichment, and replay workflows using custom JavaScript functions and Regex patterns. To automate deployment and configuration management, the engineer will utilize Python, Bash, Ansible, or Terraform. The position requires expertise in logging, observability, and SIEM architecture, alongside knowledge of transport protocols like HTTP, TCP, and TLS. Candidates must possess an active TS/SCI clearance and demonstrate proficiency in data collection, indexing, and search architecture to solve complex data ingestion challenges within the organization's infrastructure.
Build and optimize high-throughput data pipelines using Cribl Stream and Cribl Edge.
Normalize incoming log sources to standardized schemas like CIM and ECS for downstream SIEM platforms.
Implement complex routing logic, data masking, and enrichment using custom JavaScript functions and Regex patterns.
Monitor system health, manage worker topology, and troubleshoot bottlenecks in the data flow.
Automate deployment and configuration management using Python, Bash, Ansible, or Terraform.
Maintain technical documentation, runbooks, and standard operating procedures for observability infrastructure.
What we're looking for
3+ years of experience in information technology focusing on logging, observability, or SIEM engineering.
Experience operating and managing data pipelines with Cribl Stream or Cribl Edge in a production environment.
Experience administering or engineering enterprise SIEM environments.
Active TS/SCI clearance and willingness to take a polygraph exam.
Required education and experience combinations: HS diploma plus 7 years, Associate’s degree plus 5 years, Bachelor’s degree plus 3 years, or Master’s degree plus 1 year of IT support.
Ability to obtain DoD 8570 IAT Level III Certification within 60 days of start date.
Ability to obtain DoD 8570 Cybersecurity Service Provider - Infrastructure Support (CSSP-IS) Certification within 30 days of start date.
Ability to obtain a Cribl Certified Observability Engineer (CCOE) certification within 30 days of start date.
Experience with Linux/Unix administration, complex Regex, and JavaScript for data transformation (preferred).
Knowledge of transport protocols, data security fundamentals, and log normalization schemas like CIM or ECS (preferred).
Enterprise SIEM Administrator or Engineering Certifications (preferred).