SIEM & Elastic Security Engineer

Job Description

1. Maintain enterprise SIEM platforms and high-availability clusters;
2. Develop scalable log ingestion pipelines using diverse security data sources.
3. Normalize and optimize security telemetry using ECS, indexing strategies, and lifecycle management policies.
4. Develop, tune, and maintain detection rules, and dashboards;
5. Build automation workflows and scripts to enhance security operations.
6. Support security analyst in alerts investigation, forensic analysis, and threat intelligence operationalization.
7. Monitor and optimize SIEM performance and availability.
8. Mentor junior engineers and promote security engineering best practice

Qualification

1. More than 3 years of cybersecurity engineering experience, including operating enterprise SIEM and large-scale Elastic Stack environments.
2. Advanced knowledge of Elasticsearch, Logstash, Kibana, Fleet, index management, mappings, shard allocation, and security log analytics.
3. Hands-on experience with Linux, Windows Server, cloud platforms, containers, and enterprise storage and networking technologies.
4. Proficient in scripting with Python, PowerShell, and Bash.
5. Strong understanding of security technologies, incident response, and the MITRE ATT&CK framework.
6. Experience in log collection, parsing, normalization, detection engineering, threat monitoring, and security automation across enterprise environments.
7. Analytical, adaptable, and collaborative.
8. Proven industry certifications (Elastic Certified Engineer, Elastic Certified SIEM Analyst, or comparable)
9. High level of integrity, professionalism, and ethical conduct in handling sensitive security information and systems.