2 months ago
Portugal (city not specified)Senior
Responsibilities
- Build and maintain security telemetry ingestion into Elasticsearch from cloud provider audit logs, identity and SaaS activity, endpoint data, and asset data.
- Integrate third-party and cloud-provider APIs while handling authentication, pagination, rate limits, concurrency, schema changes, and errors.
- Operate, monitor, upgrade, and maintain Elastic Cloud on Kubernetes clusters, including capacity, shards, index lifecycle management, and cross-cluster search.
- Use Terraform to manage cloud infrastructure and Elasticsearch resources, including pipelines, index templates, and alerts.
- Use Kubernetes and Helm to deploy scheduled ingestion jobs and troubleshoot workloads.
- Develop automation such as self-healing jobs, health checks, alerting, internal CLIs, and AI- or agent-assisted investigation and operations workflows.
- Own security-data quality and reliability by monitoring data flow, backfills, schema and field consistency, and costs.
Requirements
- Production experience operating Elastic or Elasticsearch, including ingest pipelines, index templates, mappings, queries, cluster health, and upgrades.
- Experience with Elastic Cloud on Kubernetes or Elasticsearch on Kubernetes is strongly preferred.
- Proven ability to use AI to accelerate development, debug complex systems, and improve operations while retaining ownership of outcomes.
- Experience deploying and operating Kubernetes workloads, scheduled jobs, Helm charts, and operators, including pod and job troubleshooting.
- Experience managing cloud and Elasticsearch resources as code with Terraform.
- Experience consuming REST APIs for ingestion, including authentication, pagination, rate limiting, concurrency, and error handling.
- Ability to read, write, and modify Python ingestion and automation scripts.
- Eligibility to work in Department of Defense Impact Level 4 or higher cloud service environments.
- Cloud-provider experience, preferably GCP, including audit and logging data, is a bonus.
- Knowledge of GitHub, pull-request workflows, GitHub Actions, and continuous integration is a bonus.
- Knowledge of SOC operations, incident response workflows, and security telemetry use during investigations is a bonus.
- Ability to develop and use dashboard and visualization tools is a bonus.
Benefits
- Base salary with no variable compensation component.
- Health coverage for employees and families in many locations.
- Flexible locations and schedules for many roles at the distributed company.
- Generous vacation allowance.
- Matching donations or service contributions up to $2,000 or local currency equivalent.
- Up to 40 hours annually for volunteer projects.
- At least 16 weeks of parental leave.
Tech Stack
About Elastic
Elastic builds the Elasticsearch-based platform for enterprise search, observability (logging, metrics, APM), and security (SIEM/endpoint). It sells subscriptions and Elastic Cloud managed services with usage-based pricing, combining open source and proprietary features through Elasticsearch and Kibana. Founded in 2012 and headquartered in San Francisco, Elastic is publicly traded on the NYSE and is used by more than half of the Fortune 500.