SIEM Solution Architect

Identifi Global; Greater London; Hybrid; GBP 110,000 - 170,000; Full time

Job summary

Identifi Global is seeking an experienced SIEM/SOC Security Architect to lead the design and delivery of Elastic/ELK-based architectures for UK Defence and international NATO environments. The role combines architecture with hands-on delivery and client-facing engagement.

You will work with a team of SMEs, shaping solutions, identifying risks, and ensuring secure, compliant deployments across complex environments. A DV clearance and UK-based security-focused delivery are essential.

Qualifications

• DV clearance (active) is required
• Experience designing and delivering SIEM/SOC architectures
• Strong security architecture knowledge with Elastic/ELK
• Experience working directly with end clients and SME teams

Responsibilities

• Design SOC/SIEM architectures using Elastic/ELK
• Translate client requirements into practical technical solutions
• Provide SME-level guidance during delivery
• Support ongoing SIEM implementations and improvements

Skills

Client engagement

Stakeholder mgmt

Security architecture

SME leadership

Tools

Elasticsearch

Kibana

Logstash

Elastic Agent / Beats

Job description

Location - UK / Hybrid with regular client-site delivery, typically London

Current and active DV clearance required

An opportunity to join one of the leading Elastic partners as it continues to expand an established specialist security and Elastic practice.

You will become part of a team of 30+ specialist SMEs delivering complex security and technology projects extensively across UK Defence, alongside international work within NATO environments.

The practice is entering a significant period of growth following the award of major new projects and is expanding its permanent technical capability.

They are now looking to appoint an experienced SIEM / SOC Security Architect who can combine strong security architecture knowledge with practical Elastic/ELK experience.

This is not intended to be a purely advisory architecture position. You will work directly with end clients to understand their requirements, shape the solution and define the appropriate SIEM/SOC architecture, while remaining close to the technical delivery.

Projects are expected to include both greenfield implementations and recovery of existing environments, providing exposure to complex and highly sensitive security environments.

What will you do ?

• Working directly with end clients to understand technical, operational and security requirements
• Designing SOC and SIEM architectures incorporating Elastic/ELK technologies
• Translating client requirements into practical technical solutions and architectures
• Providing SME-level guidance throughout implementation and delivery
• Supporting greenfield SIEM implementations
• Assessing and supporting the recovery or improvement of existing environments
• Working alongside an established team of specialist SMEs
• Contributing directly to technical delivery where appropriate
• Communicating architectural decisions, technical risks and recommendations to client stakeholders
• Supporting successful delivery within complex and security-sensitive environments

We are particularly interested in candidates who can demonstrate:

• Current and active DV clearance
• Professional experience working with Elastic / ELK
• Evidence of what you have personally designed and delivered within relevant environments
• Ability to operate at SME/Architect level directly with end clients
• Strong stakeholder management and communication skills
• Experience working within complex, security-sensitive environments

Nice to have, but not essential

• Relevant Elastic certification
• Hands-on Elastic engineering and implementation
• Elasticsearch, Kibana and Logstash
• Elastic Agent / Beats
• SIEM implementation and optimisation
• Troubleshooting or recovery of existing Elastic environments
• Wider SOC architecture and security tooling experience

Candidates who meet the core clearance, architecture and Elastic requirements but do not currently hold the relevant Elastic certification may still be considered.

Working Arrangements

This is a permanent, hybrid position.

When not required at a client site, there will be scope to work remotely. However, due to the nature and security classification of the projects, candidates should be comfortable with regular and potentially significant client-site attendance.

Projects are expected to be predominantly across the South of England towards London, although exact requirements will depend on individual engagements.

Why Consider the Opportunity?

This is an opportunity to join an established specialist practice at a point of significant expansion rather than simply joining for a single assignment.

You will work alongside 30+ SMEs, delivering challenging security projects across Defence and international environments, while contributing to the continued development of the organisation's Elastic and security capability.

Alongside Defence engagements, there may also be opportunities to contribute to wider enterprise projects.