Elastic Stack Engineer

Job Description:

Elastic Stack Engineer

(Search & Observability)

As an Elastic / Observability & Security Platform Engineer, you will lead the design, implementation, monitoring and continuous improvement of our Elastic-based observability and security stack. You will take ownership of detection rules, watchers, ML-models, health monitoring of data streams, alerting frameworks, and tracking of data pipeline latency/integration times. You will work closely with data engineers, security operations, platform engineering, and business-units to ensure robust real-time monitoring, anomaly detection, alerting, and data integration observability.

• Architect, deploy, configure and optimise the Elastic Stack (Elasticsearch, Kibana, Beats, Logstash, Elastic Machine Learning, Elastic Watcher/Alerting).
• Develop and maintain JSON-based configuration files, logic and pipelines for detection rules, watchers and alerting states.
• Design, build and ope rationalise machine-learning jobs within Elastic ML (e.g., anomaly detection, forecasting, classification) for observability/security use-cases.
• Monitor, maintain and improve the health and performance of data-streams (logs, metrics, events, traces) ingesting into the Elastic cluster: ensure data freshness, minimal latency, correct mapping, index lifecycle management (ILM), shard management, and cluster health.
• Implement and maintain alerting/notification frameworks: watchers/triggers, custom alert-logic via JSON, integration with downstream systems (Slack, Teams, Pager Duty, email, webhook).
• Track and report on the integration time between upstream data sources and the Elastic ingestion pipeline (i.e., latency from source → pipeline → index → availability), diagnose and mitigate delays or bottlenecks.
• Develop dashboards, visualisations and reports in Kibana to communicate KPIs, SLAs (data-ingestion, alert-response, model accuracy), and to drive continuous improvement.
• Collaborate with data engineering, Dev Ops, security operations (Sec Ops), SRE and business stakeholders to define requirements and deliver effective observability/security solutions.
• Establish best‑practices, standards and documentation for JSON rule-configs, watchers, ML-jobs, dashboarding and monitoring.
• Participate in incident-response processes: support triage, root-cause analysis and feed learnings back into detection rules/ML jobs/monitoring.
• Stay up-to-date and contribute to improving the Elastic ecosystem in our environment: new features, upgrades, tuning, cost-optimisation, benchmark/scale testing.

• Strong hands‑on experience with the Elastic Stack (Elasticsearch, Kibana, Beats, Logstash or equivalent ingestion pipelines) – you should be comfortable deploying, configuring and operating production Elastic clusters.
• Proficiency in writing and using JSON configurations and logic for detection rules, watchers, alerting frameworks, and monitoring pipelines.
• Experience building and ope rationalising Elastic Machine Learning jobs (anomaly detection, forecasting, classifications) and interpreting model output for observability/security use-cases.
• In‑depth experience monitoring and maintaining the health of high-volume data streams: log/metric/event/tracing data, with attention to data latency, ingestion batching, pipeline failures, index lifecycle, and cluster resource optimisation.
• Experience designing end‑to‑end alerting workflows (trigger logic, thresholds, multi‑condition rules, escalation, notification integration).
• Experience tracking and measuring integration times (data latency from source ingestion to availability in index/dashboards) and implementing improvements to reduce that latency.
• Strong scripting or programming ability (e.g.,…