Senior Information Security Infrastructure Engineer

Elastic, the Search AI Company, provides the Elastic Search AI Platform used by more than 50% of the Fortune 500 for search, security, and observability.

Join the InfoSec - Security Architecture team as a Senior Information Security Infrastructure Engineer, protecting the organization's data and systems.

• Build and maintain ingestion of security-relevant data into Elasticsearch, including cloud provider audit logs, identity/SaaS activity, endpoint and asset data.
• Integrate with third-party and cloud provider APIs, handling auth, pagination, rate limits, and schema changes.
• Keep Elastic Cloud on Kubernetes clusters healthy, including monitoring, upgrades, capacity, shards, and index lifecycle management (ILM).
• Enable cross-cluster search (CCS).
• Use Terraform to manage cloud infrastructure and Elasticsearch resources, including pipelines, index templates, and alerts.
• Utilize Kubernetes and Helm to deploy scheduled ingest jobs.
• Use AI automation and tooling to reduce toil, including self-healing jobs, health checks, alerting, internal CLIs, and AI/agent-assisted workflows.
• Own data quality and reliability: monitor backfills, ensure schema consistency, and manage costs.

• Ability to operate Elastic and Elasticsearch in production, including ingest pipelines, index templates, mappings, and queries.
• Experience with ECK or Elasticsearch on Kubernetes strongly preferred.
• Proven track record of using AI to accelerate development, debug complex systems, and accelerate operations.
• Kubernetes: deploying and operating workloads (scheduled jobs, Helm charts, operators); troubleshooting pods/jobs.
• Terraform: managing cloud and Elasticsearch resources as code.
• API integration: consuming REST APIs for data ingestion (authentication, pagination, rate limiting, error handling).
• Python scripting: able to read, write, and modify ingestion/automation scripts.
• Eligibility to work in DoD Impact Level 4 or above cloud service environments.
• Bonus: Experience with cloud providers, preferably GCP, and audit/logging data; knowledge of GitHub, PR-based workflows, GitHub Actions, and CI; knowledge of SOC operations and incident response workflows; ability to develop and use dashboard/visualization tools.

Base salary only; no variable component. Typical starting salary range: €87,300—€138,000 EUR.