Senior Information Security Infrastructure Engineer - Security Architecture - InfoSec

About This Role

Joining the Info Sec - Security Architecture team as a Senior Information Security Infrastructure Engineer, you will play a key role in protecting the organization's data and systems. This position offers the opportunity to work on meaningful projects that directly impact the security posture and collaborate with a skilled team passionate about information security. You will own the pipeline end to end, from a new security data source landing, through ingest pipelines, into the indices detection, IR, and consulting teams query, plus the clusters that store it all.

Responsibilities

• Build and maintain ingestion of security-relevant data into Elasticsearch (cloud provider audit logs, identity/SaaS activity, endpoint and asset data)
• Integrate with third-party and cloud provider APIs to pull telemetry, handling authentication, pagination, rate limits, and schema changes
• Utilize both Elastic integrations and one-off custom integrations
• Keep the Elastic Cloud on Kubernetes clusters healthy, monitoring and upgrading them regularly
• Update versions and builds, manage capacity and shards, and handle index lifecycle management (ILM)
• Enable cross-cluster search (CCS)
• Use Terraform to manage cloud infrastructure and Elasticsearch resources, including pipelines, index templates, and alerts
• Utilize Kubernetes and Helm to deploy scheduled ingest jobs
• Use AI automation and tooling to reduce toil, including self-healing jobs, health checks, alerting, internal CLIs, and AI or agent-assisted workflows for investigation and operations
• Own data quality and reliability, monitoring backfills and ensuring consistent schemas and fields
• Monitor costs related to data ingestion and storage

Requirements

• Ability to operate Elastic and Elasticsearch in production, including managing ingest pipelines, index templates, mappings, and queries, while ensuring healthy and upgraded clusters
• Experience with ECK or Elasticsearch on Kubernetes is strongly preferred
• Proven track record of using AI to accelerate development, debug complex systems, and accelerate operations, while still owning the final outcomes
• Experience with Kubernetes, including deploying and operating workloads (scheduled jobs, Helm charts, operators) and troubleshooting pods/jobs in a cluster
• Experience with Terraform, managing cloud and Elasticsearch resources as code
• API integration skills, consuming REST APIs for data ingestion: authentication, pagination, rate limiting concurrency, and error handling
• Python scripting skills, able to read, write, and modify ingestion/automation scripts at a scripting level

Nice to have:

• Experience with cloud providers, preferably GCP, and working with audit and logging data