Senior Elasticsearch Engineer — SIEM Platform

The Vanguard Group; Malvern (Chester County); Hybrid; USD 140,000 - 200,000; Full time

Job summary

The Vanguard Group seeks an Elasticsearch Lead Engineer to architect and maintain high-availability Elasticsearch clusters supporting large-scale security event ingestion and analytics.

You will define ECS mappings, build ingestion pipelines, and integrate with AWS services such as S3, Kinesis, Lambda, and CloudWatch. Collaborate with Detection Engineering to optimize index strategies and Kibana dashboards; participate in DR planning and security hardening.

Qualifications

• Six years of related work experience.
• Undergraduate degree or equivalent combination of training and experience.
• 6+ years of Elasticsearch / Elastic Stack experience in a production security or observability environment.
• Deep understanding of Elastic Common Schema (ECS) and mapping logs to ECS.
• Hands-on experience operating Elasticsearch at scale (10TB+/day ingest, 100+ node clusters).
• Proficiency with AWS - Kinesis, S3, IAM, CloudTrail, and AWS-native log sources.
• Experience with data streaming platforms like Apache Kafka or Confluent Platform.
• Knowledge of security principles: least privilege, network segmentation, audit logging.

Responsibilities

• Architect and maintain high-availability Elasticsearch clusters for large-scale security event ingestion.
• Define and enforce ECS field mappings across data sources for consistent detection analytics.
• Design and develop data ingestion pipelines using Elasticsearch.
• Integrate with AWS services including S3, Kinesis Data Streams, Lambda, and CloudWatch for log collection.
• Manage AWS infrastructure: EC2, S3, IAM, Secrets Manager via CloudFormation.
• Implement ILM policies and snapshot/restore to S3 data lakes.
• Collaborate with Detection Engineering and Threat Intelligence to optimize index strategies and dashboards in Kibana.
• Establish cluster security controls: TLS/mTLS, RBAC, audit logging, encryption at rest.
• Build resilient architectures: cross-cluster replication, disaster recovery runbooks.
• Mentor junior engineers and establish best practices, runbooks, and architectural standards.

Skills

Elasticsearch

Elastic Stack

Kibana

AWS

Ingestion pipelines

Security analytics

IaC

Disaster recovery

Education

Undergraduate degree in a related field

Tools

Terraform

CloudFormation

CDK

EC2

S3

Kafka

Iceberg

Job description

The Vanguard Group seeks an Elasticsearch Lead Engineer to architect and maintain high-availability Elasticsearch clusters supporting large-scale security event ingestion and analytics.

You will define ECS mappings, build ingestion pipelines, and integrate with AWS services such as S3, Kinesis, Lambda, and CloudWatch. Collaborate with Detection Engineering to optimize index strategies and Kibana dashboards; participate in DR planning and security hardening.