Data Engineer - Journeyman

Job Description

ECS is seeking a Data Engineer – Journeyman to support the Army National Guard (ARNG) Enterprise Network Operations and Cybersecurity Support (ENOCS) program. The selected candidate will engineer data integration solutions that enable reliable ingestion, parsing, and transformation of cybersecurity telemetry across SOC, CDAP, and analytic platforms. The Data Engineer will work closely with analytic developers, security engineers, and cybersecurity operations personnel to improve data quality, resolve ingestion discrepancies, and sustain the data pipelines that support continuous monitoring, threat detection, and Defensive Cyberspace Operations – Internal Defensive Measures (DCO-IDM) across the DoDIN‑Army‑NG area of responsibility.

• Engineer data integration solutions that support the ingestion, parsing, normalization, and transformation of cybersecurity telemetry across SOC, CDAP, and analytic platforms.
• Implement schema management and data validation routines to improve the accuracy, traceability, and reliability of cybersecurity reporting and monitoring outputs.
• Optimize data pipeline performance to support scalable analytics and continuous monitoring across ARNG classified and unclassified network environments.
• Collaborate with analytic developers and security engineers to improve data quality, troubleshoot ingestion discrepancies, and sustain visibility for cyber defense operations.
• Support SOC monitoring and analysis by enabling high-quality data feeds for USIEM analytics, including correlation of events from integrated SIEM, C2C, and DLP data sources.
• Help maintain telemetry pipelines that leverage sources identified in the ENOCS environment, including Zeek metadata and Sysmon-based monitoring aligned to MITRE ATT&CK‑informed analytics.
• Contribute to the data foundation used for threat detection, incident analysis, and reporting supporting 24×7×365 cybersecurity operations across the DoDIN‑Army‑NG area of responsibility.
• Coordinate with cybersecurity operations stakeholders to ensure data integration supports DCO‑IDM activities and aligns with ARNG and DoD cybersecurity policy.
• Support continuous monitoring visibility and reporting used by cyber operations teams working in coordination with NETCOM Global Cyber Center and DISA DCDC.

• U.S. Citizenship is required.
• Security Clearance:
  Secret Eligible.
• Required
  
  Certifications:
  
  DCWF Work Role 511‑Cyber Defense Analyst – Basic proficiency; must hold ONE OR MORE of the following: CC, CEH, GFACT, GISF.
• Experience:
  
  3+ years of experience in cybersecurity.
• Experience engineering or supporting data ingestion, parsing, and transformation workflows for cybersecurity telemetry.
• Experience implementing data validation, schema management, and data quality controls to improve accuracy and reliability of analytic outputs.
• Experience working with security analysts, analytic developers, or security engineers to resolve data discrepancies and improve continuous monitoring visibility.
• Ability to support data integration requirements for SOC or cyber defense operations in classified and unclassified environments.
• Experience supporting reporting or analytics in environments using SIEM‑centric monitoring and correlated security data feeds.
• Ability to document data integration issues, support remediation efforts, and maintain traceability of cybersecurity data artifacts.

• Security Clearance:
  Active Secret (preferred).
• Experience supporting cybersecurity data feeds and analytics in environments using USIEM, EDR, C2C, or DLP capabilities.
• Familiarity with cybersecurity telemetry sources such as Zeek metadata and Sysmon monitoring in support of MITRE ATT&CK‑based analytics.
• Experience supporting ARNG, Army, or DoD enterprise cybersecurity operations spanning large‑scale user and endpoint environments.
• Familiarity with continuous monitoring and cyber operations supporting both NIPRNet and SIPRNet environments.
• Experience working with cross‑functional cyber teams supporting SOC operations, threat detection, incident analysis, or CDAP activities.

ECS Federal LLC is an equal opportunity employer and does not discriminate or allow discrimination on the basis of any characteristic protected by law. All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, or local jurisdiction law.