Elastic EDR Security Engineer – Threat Detection & Response

Core42; United Arab Emirates; On-site; AED 350,000 - 550,000; Full time

Benefits offered by this job

Competitive salary

Yearly bonus

Discount cards (Esaad & Fazaa)

Premium family insurance

Learning & Development

Job summary

Core42 in Abu Dhabi, UAE, is seeking a Security Engineer with hands-on Elastic Security Platform experience to design, deploy and optimize the Elastic EDR across enterprise environments. You will collaborate with Security Operations, Platform Engineering, Infrastructure and Compliance to strengthen cyber defence, while advancing detection engineering, threat hunting and incident response capabilities.

The role focuses on designing, implementing and tuning EDR, ensuring security across

Qualifications

• Bachelor's degree in Cyber Security, Computer Science, Information Security or related discipline.
• 5 to 7 years of experience in security engineering, incident response, threat hunting or detection engineering.
• Experience supporting enterprise-scale EDR deployments (10,000+ endpoints preferred).
• Hands-on expertise across Elastic Security, Elastic Defend, Elastic Agent, Elasticsearch and Kibana.
• Detection rule engineering, threat hunting and log analysis.
• Endpoint security, Windows security and Linux security.
• MITRE ATT&CK framework, incident response and malware analysis fundamentals.

Responsibilities

• Design, deploy, configure and maintain Elastic EDR infrastructure and endpoint security agents
• Manage Elastic Agent lifecycle activities, including deployment, upgrades, troubleshooting and policy management
• Develop and maintain EDR baselines, security policies and endpoint hardening standards
• Ensure high availability, scalability, performance and health of the Elastic Security platform
• Integrate Elastic EDR with SIEM, SOAR, IAM, vulnerability management and threat intelligence platforms
• Upgrade, patch and maintain existing clusters
• Develop, tune and maintain detection rules and security use cases within Elastic Security
• Enhance threat detection capabilities to reduce false positives and improve security visibility
• Design and implement behavioural analytics, anomaly detection and advanced threat detection logic
• Create custom dashboards, alerts, reports and visualisations within Kibana
• Conduct proactive threat hunting activities using Elastic Security datasets
• Investigate endpoint security incidents, malware infections, insider threats and advanced attacks
• Analyse telemetry, process activities, file events, registry modifications, network connections and user behaviour
• Support digital forensics and incident response investigations
• Identify root causes and recommend mitigation strategies
• Monitor EDR platform performance, coverage and security effectiveness
• Perform continuous tuning of endpoint security controls
• Establish KPIs and operational metrics for EDR effectiveness
• Validate security controls through attack simulation and red team exercises
• Integrate Elastic EDR with IDP, LDAP, AI and ML integrations, vulnerability management solutions, SIEM platforms, threat intelligence feeds and SOAR workflows
• Integrate with OpenStack, OpenShift, NVIDIA and AMD systems
• Automate security operations using APIs, scripts and orchestration tools
• Ensure EDR deployment aligns with NIST SP 800-53, ISO 27001, SOC 2, CIS Controls and internal security standards and policies
• Support audit activities and provide security evidence when required
• Maintain security documentation, procedures and operational runbooks

Skills

Threat hunting

Detection engineering

Incident response

Endpoint security

Windows security

Linux security

MITRE ATT&CK

Education

Bachelor's degree in Cyber Security, Computer Science, Information Security or related discipline

Tools

Elastic Security Platform

Elastic Agent

Elasticsearch

Kibana

Job description

Core42 in Abu Dhabi, UAE, is seeking a Security Engineer with hands-on Elastic Security Platform experience to design, deploy and optimize the Elastic EDR across enterprise environments. You will collaborate with Security Operations, Platform Engineering, Infrastructure and Compliance to strengthen cyber defence, while advancing detection engineering, threat hunting and incident response capabilities.

The role focuses on designing, implementing and tuning EDR, ensuring security across