[Hiring] Senior Information Security Infrastructure Engineer @Elastic

Role Description

Join the InfoSec - Security Architecture team as a Senior Information Security Infrastructure Engineer, where you'll have the chance to play a key role in protecting our organization's data and systems. This position offers the opportunity to work on meaningful projects that directly impact our security posture and collaborate with a skilled team passionate about information security.

In more details:

• We ingest the security telemetry that the whole security org runs on.
• You'll get that telemetry into Elasticsearch consistently and keep the underlying Elastic clusters healthy.
• You own the pipeline end to end: from a new security data source landing, through ingest pipelines, into the indices detection, IR, and consulting teams query, plus the clusters that store it all.

What You Will Be Doing

• Security telemetry ingestion - build and maintain ingestion of security-relevant data into Elasticsearch (cloud provider audit logs, identity/SaaS activity, endpoint and asset data).
• Integrate with third-party and cloud provider APIs to pull telemetry: auth, pagination, rate limits, and handling schema changes.
• Keep the Elastic Cloud on Kubernetes clusters healthy. Monitor and upgrade them regularly.
• Manage capacity and shards. Handle index lifecycle management (ILM). Enable cross-cluster search (CCS).
• Use Terraform to manage cloud infrastructure and Elasticsearch resources.
• Utilize Kubernetes and Helm to deploy scheduled ingest jobs.
• Use AI automation and tooling to reduce toil, including self-healing jobs and health checks.
• Own the "is the security data actually flowing correctly?" question. Monitor backfills.
• Ensure that schemas and fields are consistent. Keep an eye on costs.

Qualifications

• Ability to operate Elastic and Elasticsearch in production.
• Experience with ECK or Elasticsearch on Kubernetes is strongly preferred.
• Proven track record of using AI to accelerate development, debug complex systems, and accelerate operations.
• Kubernetes - deploying and operating workloads; troubleshooting pods/jobs in a cluster.
• Terraform - managing cloud and Elasticsearch resources as code.
• API integration - consuming REST APIs for data ingestion.
• Python scripting - able to read, write, and modify ingestion/automation scripts.
• Eligibility to work in Department of Defense (DoD) Impact Level 4 or above cloud service environments.

Bonus Points

• Experience with cloud providers.
• Hands-on experience with cloud providers, preferably GCP, and working with audit and logging data.
• Knowledge of GitHub, PR-based workflows, GitHub Actions and Continuous Integration (CI).
• Knowledge of SOC operations and incident response (IR) workflows.
• Ability to develop and use dashboard/visualization tools.

Benefits

• Competitive pay based on the work you do here and not your previous salary.
• Health coverage for you and your family in many locations.
• Ability to craft your calendar with flexible locations and schedules for many roles.
• Generous number of vacation days each year.
• Increase your impact - We match up to $2000 (or local currency equivalent) for financial donations and service.
• Up to 40 hours each year to use toward volunteer projects you love.
• Embracing parenthood with a minimum of 16 weeks of parental leave.