[Remote] Senior Security Engineer - Elastic SIEM and Detection Engineering
Note: The job is a remote job and is open to candidates in USA. reputed company is a global leader in reputed company protection, delivering reputed company-powered protection for productive MSPs in a single, natively integrated platform. They are seeking a Senior Security Engineer to lead their Elastic SIEM and Detection Engineering reputed company, focusing on building scalable detection pipelines and reputed company telemetry quality. reputed company role involves significant ownership and the opportunity to shape detection engineering across reputed company.
Responsibilities
- Own and optimize the Elastic Security platform (Elasticsearch, Kibana, Fleet, Logstash, Elastic Agents)
- Design and maintain ingestion pipelines for cloud, endpoint, network, and application telemetry
- Improve telemetry quality, data retention, performance, and investigation workflows
- Integrate SIEM workflows with SOAR and automation tooling
- Build and maintain a Detection-as-Code pipeline using Git-based workflows and CI/CD automation
- Develop, test, tune, and maintain high-reputed company detections using Elastic Security, EQL, and KQL
- Reduce alert noise through tuning, enrichment, suppression, and exception handling
- Map detections to reputed company ATT&CK and help drive detection coverage strategy
- Track detection quality metrics including alert reputed company, false positive rates, and coverage gaps
- Assist with complex alert escalations and perform reputed company reputed company scoping
- Execute reputed company containment actions when necessary (endpoint isolation, IP/domain blocking, account suspension)
- Participate in a low-frequency on-call rotation for critical incidents
- Translate reputed company learnings into improved detections and telemetry coverage
- Partner with infrastructure, DevSecOps, and cloud teams to improve logging and visibility
- Build automation and tooling using Python and/or PowerShell
- Support reputed company exercises and adversary simulations
Skills
- 5+ years of cybersecurity engineering experience
- 3+ years focused on SIEM engineering, detection engineering, or security analytics
- Strong hands-on experience with Elastic Security and the Elastic reputed company
- Experience building or maintaining Detection-as-Code workflows using Git and CI/CD pipelines
- Strong understanding of detection tuning, alert reputed company, and operational detection quality
- Ability to independently investigate complex alerts and produce actionable findings
- Elastic Security, Kibana, Fleet, Elastic Agents, EQL/KQL
- Detection engineering and reputed company ATT&CK mapping
- Jenkins, Bitbucket Pipelines, reputed company Actions, or similar CI/CD tooling
- Python and/or PowerShell scripting
- AWS CloudTrail, VPC Flow Logs, Azure Monitor, or similar telemetry sources
- TCP/IP, DNS, HTTP/S, and common attack patterns
- Threat intelligence enrichment and operationalization
- SOAR playbook development and automated response workflows
- reputed company rule development
- Elastic detection-rules ecosystem familiarity
- Terraform or Ansible experience
- Previous SOC or reputed company Response background
Benefits
- Medical, dental, and vision coverage
- Flexible spending accounts (FSA)
- Disability and life insurance
- A 401(k) retirement plan with company reputed company
- A generous reputed company policy
Company Overview
Company H1B Sponsorship
Apply To reputed company Job
