Elasticsearch Lead Engineer – SIEM Platform Architect

Vanguard; Malvern (Chester County); On-site; USD 170,000 - 230,000; Full time

Job summary

Vanguard is seeking an Elasticsearch Lead Engineer for the SIEM Platform in the United States. You will architect and maintain high-scale Elasticsearch clusters supporting security event ingestion and detection analytics.

You will map ECS across data sources, design ingestion pipelines, and integrate with AWS services like S3, Kinesis, Lambda, and CloudWatch. You will also enforce security controls and runbooks, and mentor junior engineers.

Qualifications

• 6+ years Elasticsearch / Elastic Stack in production security or observability
• Mapping logs to ECS across Windows, Linux, cloud and EDR
• Scale: 10TB+/day ingest, 100+ node clusters
• Hands-on with AWS services: S3, Kinesis, CloudWatch, IAM
• Security controls: TLS, RBAC, audit logging
• IaC tools: Terraform / Ansible / CDK

Responsibilities

• Architect and maintain high-availability Elasticsearch clusters for large-scale security event ingestion
• Define ECS field mappings across sources for consistent detection and analytics
• Design data ingestion pipelines and integrate with AWS services for log collection
• Manage AWS infrastructure using CloudFormation
• Implement ILM policies and data lifecycle for S3-based data lakes
• Collaborate with Detection Engineering and Threat Intelligence on index strategies
• Establish cluster security controls: TLS, RBAC, audit logging, encryption at rest
• Build resilient architectures with cross-cluster replication and DR runbooks
• Monitor platform health and perform upgrades/patching
• Troubleshoot production Elasticsearch cloud issues
• Define and enforce SLOs for ingestion latency, queries, and availability
• Mentor engineers and establish runbooks and standards

Skills

Elasticsearch expertise

Cloud security fundamentals

Leadership / mentoring

Production-grade systems

Education

Bachelor's degree in related field

Tools

AWS

Terraform

Ansible

CDK

Kubernetes

Job description

Vanguard is seeking an Elasticsearch Lead Engineer for the SIEM Platform in the United States. You will architect and maintain high-scale Elasticsearch clusters supporting security event ingestion and detection analytics.

You will map ECS across data sources, design ingestion pipelines, and integrate with AWS services like S3, Kinesis, Lambda, and CloudWatch. You will also enforce security controls and runbooks, and mentor junior engineers.