EDR Platform Engineer

malomatia; Doha; Sur place; QAR 220 000 - 360 000; Plein temps

Résumé du poste

Malomatia is seeking an experienced EDR Platform Engineer-Elastic Security to administer and enhance an enterprise Elastic Security and Endpoint Detection & Response environment. The role demands strong Elastic expertise, Linux administration, and cybersecurity knowledge to improve detection, coverage, and incident-response readiness.

Key responsibilities include managing Elastic Agent deployments, Fleet Server, Elasticsearch clusters, and Kibana applications, while coordinating with SOC and

Qualifications

• 3–5+ years in cybersecurity or related roles.
• Hands-on production experience administering Elastic Stack environments.
• Experience operating EDR or endpoint-security in enterprise environments.
• Bachelor’s degree in Information Technology, Computer Engineering, Information Security or equivalent.

Responsabilités

• Administer and maintain Elastic Security and EDR environments.
• Deploy, configure, and troubleshoot Elastic Agent on Linux and Windows endpoints.
• Manage Elastic Agent via Fleet and Fleet Server, including policies and integrations.
• Monitor agent health, policy status, and data ingestion; troubleshoot issues.
• Configure detection rules to improve coverage and reduce false positives.
• Coordinate upgrades, patches, and run-books; document procedures.
• Collaborate with SOC, infrastructure, and cybersecurity teams; coordinate with vendors as needed.
• Administrate Elasticsearch clusters, indices, templates, and ILM policies.

Connaissances

Elastic Stack expertise

Linux administration

Cybersecurity fundamentals

SIEM/EDR operations

Windows endpoint security

Formation

Bachelor’s degree in IT/CS/InfoSec

Outils

Elastic Stack tools (Elasticsearch, Kibana, Logstash)

Fleet Server

Git / Python scripting

Ansible

Description du poste

We are seeking an experienced EDR Platform Engineer-Elastic Security to administer, operate, maintain, and enhance an enterprise Elastic Security and Endpoint Detection & Response environment. The ideal candidate combines strong hands‑on Elastic expertise with solid cybersecurity knowledge and advanced Linux administration and troubleshooting skills.

Role Objective

Ensure the organization’s Elastic Security platform and endpoint protection infrastructure remain secure, stable, highly available, scalable, and operationally effective while continuously improving security visibility, detection capability, endpoint coverage, and incident‑response readiness.

Key Responsibilities

• EDR Platform Administration – Elastic security
• Administer and maintain Elastic Security and Elastic Defend (EDR) environments.
• Deploy, configure, upgrade, and troubleshoot Elastic Agent on Linux and Windows endpoints.
• Manage Elastic Agent centrally through Fleet and Fleet Server, including agent policies, integrations, and endpoint policies.
• Monitor agent health, connectivity, policy status, telemetry, and data ingestion; troubleshoot offline, unhealthy, or degraded agents.
• Configure EDR prevention, detection, response, endpoint isolation, and other response capabilities.
• Manage large‑scale EDR deployment across enterprise servers and workstations and execute upgrades with minimal disruption.
• Coordinate upgrades, patches, configuration changes, technical documentation, troubleshooting procedures, and operational run‑books.
• Work closely with SOC analysts, infrastructure, network, systems, and cybersecurity teams; coordinate with vendors when escalation is required.
• Administer Elasticsearch clusters supporting Elastic Security and monitor cluster/node health, shard allocation, indexing, disk and resource utilization.
• Troubleshoot cluster, node, index, shard, authentication, authorization, connectivity, and performance issues.
• Manage index templates, component templates, data streams, ILM policies, retention, users, roles, privileges, API keys, and certificates.
• Administer Kibana and Elastic Security applications and support snapshot, restore, backup, and disaster‑recovery procedures.
• Administer and troubleshoot Logstash pipelines, including inputs, filters, outputs, and data ingestion.
• Investigate delayed, dropped, duplicated events and identify ingestion bottlenecks.
• Work with Elastic Agent integrations, Beats, Syslog, APIs, ingest pipelines, ECS, and related parsing/normalization technologies.
• Configure, maintain, and tune Elastic Security detection rules to improve coverage and reduce false positives.
• Create custom detections based on organizational threats and use cases using KQL, EQL, ES|QL, and Elasticsearch Query DSL.
• Apply process whitelisting\block-listing following the best practice approach.
• Strong Linux administration and troubleshooting capability is essential for this position.
• Linux command-line administration, systemd/systemctl, journalctl, and operating‑system log analysis.
• File systems, mounts, permissions, ownership, users, groups, sudo, and access controls.
• CPU, memory, disk, process, network, DNS, TCP/IP, SSH, and connectivity troubleshooting.
• Firewall administration, SELinux, RPM/YUM/DNF/APT package management, and Bash scripting (preferred)
• Ability to diagnose production issues directly from the Linux command line and perform structured root‑cause analysis.

Technical Skills

Required

• Strong hands‑on experience with Elastic Stack: Elasticsearch, Kibana, Elastic Security, Elastic Defend, Elastic Agent, Fleet/Fleet Server, and Logstash.
• Strong Linux administration and troubleshooting skills and good understanding of Windows endpoint security.
• Cybersecurity fundamentals, SIEM/EDR operations, security‑event analysis, and incident‑response management.

Preferred

• Elastic Cloud Enterprise (ECE), distributed/multi‑cluster Elastic architectures, high availability, and disaster recovery.
• Elasticsearch snapshot/restore, load balancers, reverse proxies, VMware or other virtualization platforms.
• Ansible or similar configuration‑management tools, Git, REST APIs, and Python scripting.

Experience & Education

• Approximately 3–5+ years of experience in cybersecurity, security engineering, infrastructure security, SIEM, EDR, or related technical roles.
• Hands‑on production experience administering Elastic Stack environments and troubleshooting complex Linux‑based systems.
• Experience operating EDR or endpoint‑security technologies in enterprise and high‑availability and critical infrastructure environment.
• Bachelor’s degree in Information Technology, Computer Engineering, Information Security or equivalent professional experience.
• Candidates with strong Elastic and Linux expertise but fewer total years of experience may also be considered.

Preferred Certifications

• Elastic Certified Engineer, Elastic Certified Analyst, or relevant Elastic certification (preferred)
• RHCSA / RHCE.
• CompTIA Security+ / CySA+ or equivalent certification
• GIAC, CISSP, or equivalent security certification (preferred)
• Strong technical troubleshooting, analytical thinking, and structured root‑cause analysis.
• Ability to troubleshoot across endpoint, network, operating‑system, ingestion, and Elasticsearch layers.
• Ability to work effectively during critical production infrastructure and communicate clearly with technical and non‑technical stakeholders.
• Strong documentation skills and ability to work independently and collaboratively across technical teams.