Elastic Security Specialist (ELK/SIEM)

Summary: The Elastic Security Specialist (ELK/SIEM) role requires an expert-level understanding of Elastic SIEM and the Elastic Stack architecture, with a focus on Elasticsearch Query DSL and Kibana dashboarding. The position involves hands-on experience with various Elastic tools and strong scripting skills, alongside a deep understanding of threat intelligence and SOC operations. The role is based in London or Birmingham and offers a hybrid working arrangement.

Key Responsibilities:

• Utilize expert-level knowledge of Elastic SIEM and Elastic Stack architecture.
• Proficiently use Elasticsearch Query DSL, EQL, and Kibana for dashboarding.
• Implement and manage Beats (Filebeat, Winlogbeat, Auditbeat) and Elastic Agent.
• Develop scripts using Python, Shell, or Painless.
• Ingest threat intelligence and integrate IOCs.
• Understand and apply MITRE ATT&CK framework and SOC operations.
• Build and optimize Logstash and Ingest Pipelines.
• Manage Elastic Agent policies for log, metric, and uptime integrations.
• Utilize Filebeat and Metricbeat modules for log ingestion.

Key Skills:

• Elastic Security
• Logstash
• Kibana
• Filebeat
• Elastic Stack

Salary (Rate): undetermined

City: London

Country: United Kingdom

Working Arrangements: hybrid

IR35 Status: undetermined

Seniority Level: undetermined

Industry: IT