This role pays less than
75%
of similar roles. Most pay
$142,437–$222,000
— the shaded band above.
At the midpoint, this role pays about
$142k
versus about
$182k
for comparable roles.
Based on 240 similar postings.
Employer
About Booz Allen Hamilton
Booz Allen Hamilton is a management and technology consulting firm that provides analytics, digital, engineering, and cybersecurity solutions primarily to U.S. government agencies and commercial clients. Industry: Management & Technology Consulting
Booz Allen Hamilton currently has
1385 open roles
on FindRole.
Listed pay typically runs
$86,800–$198,000
across 911 roles with salary data.
As a mid-level Cribl Engineer on the Visibility Analytics and Automation Team, you will build, manage, and optimize enterprise data pipelines to feed downstream SIEM ecosystems. Your daily responsibilities include designing routing, filtering, and transformation logic using Cribl Stream and Cribl Edge to ensure efficient data masking and processing. You will normalize log sources to standardized schemas like CIM and ECS while implementing complex workflows using custom JavaScript functions and Regular Expressions. To automate deployment and configuration management, you will utilize Python, Bash, Ansible, and Terraform. The role requires expertise in log forwarding, indexing, and search architecture within a production environment. Technical requirements include proficiency with HTTP, TCP, and TLS protocols, as well as experience with Linux or Unix administration to solve complex data ingestion challenges for observability infrastructure.
Build and optimize high-throughput data pipelines using Cribl Stream and Cribl Edge.
Normalize incoming log sources to standardized schemas like CIM and ECS for downstream SIEM platforms.
Implement complex routing logic, data masking, and enrichment using custom JavaScript functions and Regular Expressions.
Monitor system health, manage worker topology, and troubleshoot bottlenecks or failures in the data flow.
Automate deployment and configuration management using Python, Bash, Ansible, or Terraform.
Maintain technical documentation, runbooks, and standard operating procedures for observability infrastructure.
What we're looking for
3+ years of experience in information technology focusing on logging, observability, or SIEM engineering.
Experience operating and managing data pipelines with Cribl Stream or Cribl Edge in a production environment.
Experience administering or engineering enterprise SIEM environments.
Knowledge of log forwarding, indexing, data collection, search architecture, source types, and ingestion-time parsing.
Active TS/SCI clearance and willingness to take a polygraph exam.
Required education and experience combinations: HS diploma with 7+ years, Associate’s degree with 5+ years, Bachelor’s degree with 3+ years, or Master’s degree with 1+ year of IT support experience.
Ability to obtain DoD 8570 IAT Level III Certification within 75 days of start date.
Ability to obtain DoD 8570 Cybersecurity Service Provider - Infrastructure Support (CSSP-IS) Certification within 30 days of start date.
Experience with Linux or Unix administration (preferred).
Experience writing complex Regex for pattern matching, data extraction, and log parsing (preferred).
Experience using JavaScript within Cribl's native execution environment to write custom functions and perform advanced transformations (preferred).
Knowledge of transport protocols (HTTP, TCP, TLS), data formats (JSON, Syslog), and data security fundamentals (preferred).
Knowledge of log normalization concepts and schema alignment like CIM, ECS, or OCSF (preferred).
Enterprise SIEM Administrator or Engineering Certifications (preferred).