5 days ago
Charlotte, NC, USA or Dallas, TX, USAStaff+
Responsibilities
- Architect and maintain high-availability Elasticsearch clusters supporting large-scale security event ingestion.
- Define and enforce Elastic Common Schema mappings across diverse data sources for detection rules and analytics.
- Design and develop Elasticsearch data-ingestion pipelines integrated with AWS services.
- Manage AWS infrastructure and implement data lifecycle, ILM, snapshot, restore, replication, and disaster-recovery strategies.
- Partner with Detection Engineering and Threat Intelligence teams to optimize indices, queries, and Kibana dashboards.
- Establish cluster security controls including TLS/mTLS, role-based access control, audit logging, and encryption at rest.
- Monitor platform health, perform upgrades and patching, troubleshoot production Elasticsearch Cloud issues, and define SLOs.
- Mentor junior engineers and establish platform best practices, runbooks, and architectural standards.
Requirements
- At least six years of related work experience.
- Six or more years of Elasticsearch or Elastic Stack experience in a production security or observability environment.
- Undergraduate degree in a related field or equivalent combination of training and experience.
- Deep knowledge of Elastic Common Schema and experience mapping Windows, Linux, network, cloud, and EDR logs to ECS.
- Hands-on experience operating Elasticsearch at scale, including 10TB or more of daily ingest and clusters with more than 100 nodes.
- Proficiency with AWS, including Kinesis, S3, IAM, CloudTrail, and AWS-native log sources.
- Experience with Apache Kafka or Confluent Platform for high-throughput event ingestion.
- Experience with data lakes, including AWS S3, Lake Formation, Data Lake, or Apache Iceberg.
- Understanding of least privilege, network segmentation, secrets management, and audit logging.
- Experience with replication topologies, capacity planning, chaos engineering, and documented disaster-recovery procedures.
- Optional proficiency with Terraform, Ansible, or CDK.
- Preferred: Elastic Certified Engineer or Elastic Certified Analyst certification.
- Preferred: Elastic Security/SIEM detection rules, ML jobs, Timeline investigations, MITRE ATT&CK, ECK/Kubernetes deployments, and SOC 2, PCI-DSS, HIPAA, or FedRAMP knowledge.
Benefits
- Comprehensive health and wellness care.
- Work-life balance and investment in employees’ futures.
- Hybrid working model combining flexibility with in-person learning, collaboration, and connection.
Tech Stack
Categories
About Vanguard
Vanguard is an investment management company offering low-cost index and active mutual funds, ETFs, brokerage, retirement plans, and financial advice for individual, institutional, and advisor clients. Founded in 1975 by John C. Bogle and headquartered in Valley Forge, PA, it operates a client-owned structure in which its funds own the firm. Its business model centers on asset-based management and advisory fees.