Senior Information Security Infrastructure Engineer - Security Architecture

Join the InfoSec - Security Architecture team as a Senior Information Security Engineer, where you'll play a key role in protecting our organization's data and systems. You will own the security telemetry pipeline end to end: from new security data sources landing, through ingest pipelines, into the indices that detection, IR, and consulting teams query, plus the clusters that store it all.

• Build and maintain ingestion of security-relevant data into Elasticsearch (cloud provider audit logs, identity/SaaS activity, endpoint and asset data).
• Integrate with third-party and cloud provider APIs to pull telemetry, handling auth, pagination, rate limits, and schema changes.
• Keep Elastic Cloud on Kubernetes (ECK) clusters healthy, including monitoring, upgrading versions and builds, managing capacity and shards, and index lifecycle management (ILM).
• Enable cross-cluster search (CCS).
• Use Terraform to manage cloud infrastructure and Elasticsearch resources, including pipelines, index templates, and alerts.
• Utilize Kubernetes and Helm to deploy scheduled ingest jobs.
• Use AI automation and tooling to reduce toil, including self-healing jobs, health checks, alerting, internal CLIs, and AI or agent-assisted workflows for investigation and operations.
• Own data quality and reliability: monitor backfills, ensure schema and field consistency, and keep an eye on costs.

• Ability to operate Elastic and Elasticsearch in production, including managing ingest pipelines, index templates, mappings, and queries, while ensuring clusters are healthy and upgraded.
• Experience with ECK or Elasticsearch on Kubernetes is strongly preferred.
• Proven track record of using AI to accelerate development, debug complex systems, and accelerate operations, while still owning final outcomes.
• Kubernetes: deploying and operating workloads (scheduled jobs, Helm charts, operators); troubleshooting pods/jobs in a cluster.
• Terraform: managing cloud and Elasticsearch resources as code.
• API integration: consuming REST APIs for data ingestion, including authentication, pagination, rate limiting concurrency, and error handling.
• Python scripting: able to read, write, and modify ingestion/automation scripts (scripting-level, not full software-engineering depth).
• Eligibility to work in Department of Defense (DoD) Impact Level 4 or above cloud service environments.

• Hands-on experience with cloud providers, preferably GCP, and working with audit and logging data.
• Knowledge of GitHub, PR-based workflows, GitHub Actions and Continuous Integration (CI).
• Knowledge of SOC operations and incident response (IR) workflows, including the use of security telemetry during investigations.
• Ability to develop and use dashboard/visualization tools.

Compensation is in the form of base salary; no variable compensation component. The typical starting salary range is $133,100—$210,600 USD. In select locations (including Seattle WA, Los Angeles CA, the San Francisco Bay Area CA, and the New York City Metro Area), an alternate range of $159,900—$252,900 USD applies. This role is eligible for Elastic's stock program. Total rewards include a company-matched 401k with dollar-for-dollar matching up to 6% of eligible earnings, and other benefits with a holistic emphasis on employee well-being.

Elastic is a distributed company, offering flexible locations and schedules for many roles, generous vacation days, health coverage for you and your family in many locations, up to $2000 match for financial donations and service, up to 40 hours each year for volunteer projects, and a minimum of 16 weeks of parental leave. Elastic is an equal opportunity employer.