Elasticsearch Consultant

Consult; Greater London; Hybrid; GBP 60,000 - 80,000; Full time

Job summary

Consult is seeking an experienced Elasticsearch SIEM Engineer in the United Kingdom to design, develop and support scalable Elastic Stack solutions with a focus on security monitoring and SIEM capabilities.

You will design and maintain Elasticsearch, Logstash and Kibana environments, onboard logs from cloud, infrastructure and security sources, and create SIEM detection rules and dashboards while automating deployments with Ansible and scripting.

Qualifications

Responsibilities

• Design, deploy and maintain Elasticsearch, Logstash and Kibana environments
• Develop and optimise Logstash pipelines for security and operational data
• Onboard and enrich logs from cloud, infrastructure, network and security sources
• Create and tune Elastic SIEM detection rules, dashboards and alerts
• Improve cluster performance, resilience, scalability and data retention
• Automate deployments and configuration through Ansible and scripting
• Support containerised Elastic environments running on Kubernetes
• Manage streaming and ingestion workflows using Kafka
• Maintain CI/CD and GitLab CI/CD pipelines
• Collaborate with SOC, security, platform and infrastructure teams

Skills

SIEM engineering

Security monitoring

Log ingestion

Stakeholder management

Scripting (Python/Bash)

Data parsing/enrichment

Troubleshooting

Education

Bachelor's degree in a relevant field

Tools

Elasticsearch

Logstash

Kibana

Ansible

Kafka

Kubernetes

Argo CD

GitLab CI/CD

Job description

We are supporting a leading technology services organisation working with a major telecommunications client that is looking for an experienced Elasticsearch SIEM Engineer.

You will be responsible for designing, developing and supporting scalable Elastic Stack solutions, with a particular focus on security monitoring, log ingestion and SIEM capabilities.

Key responsibilities

• Design, deploy and maintain Elasticsearch, Logstash and Kibana environments
• Develop and optimise Logstash pipelines for security and operational data
• Onboard and enrich logs from cloud, infrastructure, network and security sources
• Create and tune Elastic SIEM detection rules, dashboards and alerts
• Improve cluster performance, resilience, scalability and data retention
• Automate deployments and configuration through Ansible and scripting
• Support containerised Elastic environments running on Kubernetes
• Manage streaming and ingestion workflows using Kafka
• Maintain CI/CD and GitOps processes through GitLab and Argo CD
• Collaborate with SOC, security, platform and infrastructure teams

Required experience

• Strong hands-on experience with Elasticsearch, Logstash and Kibana
• Experience implementing or supporting Elastic Security/Elastic SIEM
• Strong understanding of data ingestion, parsing, enrichment and alerting
• Experience with Ansible, Kafka and Kubernetes
• Experience using Argo CD and GitLab CI/CD
• Scripting experience with Python, Bash or similar
• Knowledge of Elasticsearch performance tuning, ILM, shards and cluster management
• Strong troubleshooting and stakeholder-management skills