What you'll be doing

Acting as the technical authority and SME for security data within the Elastic Security ecosystem
Designing, implementing and maintaining scalable security data ingestion pipelines into Elastic SIEM
Owning the onboarding, tuning, normalisation and stabilisation of security data feeds across cloud, endpoint, network and SaaS sources
Defining and continuously improving data quality standards to support detection, investigation and threat hunting
Contributing to the operation, performance and evolution of the Elastic Security platform
Applying software engineering and scripting skills, including in Python or Bash, to automate ingestion, validation, monitoring and operational workflows
Supporting configuration as code and infrastructure as code to improve consistency and scalability across security tooling
Driving the development of a security data strategy aligned with business and regulatory requirements

Requirements

Strong experience with Elastic Stack and data engineering technologies such as Logstash, Beats, Kafka or similar
Expertise in Elastic data modelling, indexing and performance optimisation
Experience designing scalable log collection and processing architectures
Knowledge of data governance, retention and security telemetry across cloud, endpoint and network
Experience with Azure, AWS, GCP or hybrid environments
Strategic mindset with a focus on long-term data quality and platform evolution
Strong communication skills, with ability to explain complex concepts to technical and non-technical stakeholders
Collaborative approach with experience mentoring others and working across teams to improve security outcomes