Elastic Defend Architect

Insight Global; Colorado Springs (CO); On-site; USD 100,000 - 130,000; Full time

Benefits offered by this job

Medical insurance

Vision insurance

401(k)

Job summary

A leading staffing and recruiting firm is seeking an experienced Elastic Security Architect to design and optimize Elastic Defend across enterprise environments. The ideal candidate will have deep expertise in Elastic Security technologies, EDR concepts, and collaboration skills across technical teams. Responsibilities include architecting security solutions, maintaining Elasticsearch clusters, and developing observability frameworks using Kibana. This full-time position requires a valid U.S. passport and active Secret clearance.

Qualifications

• Outstanding verbal and written communication skills.
• Valid U.S. Passport.
• Deep knowledge of modern threat landscapes.
• Proficiency in scripting languages like Python.

Responsibilities

• Architect, design, and deploy Elastic Defend for enterprise endpoint security.
• Configure and manage Fleet Servers and security policies.
• Design and maintain Elasticsearch clusters supporting Elastic Security.
• Document architectures and best practices.

Skills

Verbal and written communication skills

Ability to travel

Active Secret clearance

Hands-on experience with Elastic Security

Knowledge of SIEM and EDR

Proficiency with Linux/Unix systems

Scripting skills in Python

Tools

Elastic Security

Kibana

Cloud environments (AWS, Azure, GCP)

Job description

We are seeking an experienced Elastic Security Architect to design, deploy, and optimize Elastic Defend across large, distributed enterprise environments. This role requires deep technical expertise in Elastic Security, endpoint protection, and SIEM/EDR concepts, along with strong collaboration skills to work across SOC, Incident Response, DevOps, and cloud engineering teams.

Responsibilities

• Architect, design, and deploy Elastic Defend for enterprise endpoint security.
• Configure and manage Fleet Servers, agent enrollment workflows, and security policies.
• Design and maintain scalable Elasticsearch clusters supporting Elastic Security workloads.
• Build and optimize ingestion pipelines for endpoint telemetry, audit logs, and alerts.
• Enhance Elastic Security performance through index management, ILM tuning, and ingest pipeline improvements.
• Develop observability frameworks using Kibana for complete visibility into cluster and EDR operations.
• Implement logging, metrics, and tracing systems for real-time monitoring and detection.
• Analyze and visualize datasets to support threat hunting and anomaly detection.
• Troubleshoot Elastic Defend agent behavior, policy issues, and integration failures.
• Ensure data integrity, security, and compliance across Elastic Security components.
• Collaborate with SOC, IR, DevOps, and platform teams to align architecture with mission requirements.
• Provide technical guidance and mentoring to internal teams and stakeholders.
• Document architectures, runbooks, deployment patterns, and best practices.
• Stay current on emerging Elastic Security capabilities and evolving threat trends.

Required Skills

• Outstanding verbal and written communication skills.
• Ability and willingness to travel as needed.
• Valid U.S. Passport.
• Active Secret clearance (minimum).

Desired Skills

• Hands‑on experience architecting or administering Elastic Security / Elastic Defend in production.
• Certifications such as Elastic Certified Engineer, Elastic Certified Analyst, or Elastic Security Engineer.
• Strong understanding of SIEM and EDR concepts; experience with platforms like Elastic, Splunk, QRadar, LogRhythm, or Sentinel.
• Proficiency with Linux/Unix systems, networking fundamentals, and cloud environments (AWS, Azure, GCP).
• Experience with DevOps/SRE methodologies, automation, CI/CD, and infrastructure‑as‑code.
• Scripting skills in Python, PowerShell, or Bash.
• Deep knowledge of modern threat landscapes and endpoint attack techniques.
• Familiarity with search/indexing technologies (Solr, Lucene) is a plus.

Seniority Level

Mid‑Senior level

Employment Type

Full‑time

Job Function

Information Technology

Industries

Staffing and Recruiting

Benefits

• Medical insurance
• Vision insurance
• 401(k)