EDR Platform Engineer - Elastic Security

About the role

An organization is looking for an experienced EDR Platform Engineer to administer, operate, maintain and enhance its enterprise Elastic Security and Endpoint Detection & Response environment. The ideal candidate combines strong hands-on Elastic expertise with solid cybersecurity knowledge and advanced Linux administration and troubleshooting skills.

Key responsibilities

• Administer Elastic Security and Elastic Defend environments, deploying, configuring, upgrading and troubleshooting the Elastic Agent on Linux and Windows endpoints.
• Manage agents centrally via Fleet and Fleet Server, monitoring health, connectivity, policy status, telemetry and data ingestion, and troubleshooting offline or degraded agents.
• Configure EDR prevention, detection, response and endpoint isolation, and manage large-scale deployments across servers and workstations with minimal disruption.
• Coordinate upgrades, patches, configuration changes, technical documentation and operational runbooks, working with SOC, infrastructure, network, systems and cybersecurity teams.
• Administer Elasticsearch clusters, troubleshooting cluster, node, index, shard, authentication, authorization, connectivity and performance issues.
• Manage index templates, component templates, data streams, ILM policies, retention, users, roles, API keys and certificates.
• Administer Kibana and Elastic Security, and support snapshots, restores, backups and disaster recovery.
• Tune detection rules, create custom detections with KQL, EQL, ES|QL and Elasticsearch Query DSL, and investigate delayed, dropped or duplicated events.
• Work with Elastic Agent integrations, Beats, Syslog, APIs, ingest pipelines and ECS, and administer Logstash pipelines.
• Apply process whitelisting and block-listing following best practices.

Required profile

• Approximately 3-5+ years of experience in cybersecurity, security engineering, infrastructure security, SIEM, EDR or related roles.
• Bachelor's degree in Information Technology, Computer Engineering, Information Security or equivalent professional experience.
• Hands-on production experience with Elastic Stack environments and complex Linux systems, and experience with EDR in enterprise, high-availability and critical infrastructure settings.
• Candidates with strong Elastic and Linux expertise but fewer years of experience may also be considered.

Required skills

• Elastic Stack: Elasticsearch, Kibana, Elastic Security, Elastic Defend, Elastic Agent, Fleet/Fleet Server, Logstash.
• Linux administration and troubleshooting (RHEL, Alma Linux, Ubuntu); Windows endpoint security basics.
• Cybersecurity fundamentals, SIEM/EDR operations, security-event analysis and incident response.
• Preferred: Elastic Cloud Enterprise, multi-cluster architectures, Ansible, Git, REST APIs, Python scripting, and certifications such as Elastic Certified Engineer, RHCSA/RHCE, CompTIA Security+/CySA+, GIAC or CISSP.