ELK Support Engineer

The purpose of the ELK Support Engineer role is to manage, maintain, and optimize the Elastic Stack (Elasticsearch, Logstash, Kibana, Elastic Agent) to support real-time data ingestion, monitoring, and visualization—particularly for network and security operations.

Key Responsibilities:

• Elastic Stack Administration: Administer, scale, and maintain Elasticsearch clusters and associated Elastic Stack components. Monitor cluster health, tune performance, and manage index lifecycle policies to ensure availability and efficiency.

• Data Ingestion and Log Parsing: Design and maintain Logstash pipelines to collect, parse, and enrich data from network appliances and infrastructure systems. Implement inputs from sources such as syslog, NetFlow, and SNMP, and develop custom filters using grok, mutate, and translate.

• Visualization and Dashboards: Configure Kibana dashboards and visualizations to support operational, performance, and security monitoring, aligning with Security Operations and Network team requirements for threat detection and incident response.

• Platform Security and Compliance: Enforce secure logging practices, access control, and policy compliance across ELK infrastructure. Collaborate with audit or compliance teams to ensure logging meets organizational standards and regulatory needs.

• Collaboration and Operational Support: Provide day-to-day support for ELK-related issues across IT, Network, and Security teams. Contribute to cross-functional efforts to enhance observability, alerting, and operational resilience.

Qualifications and Requirements:

• Bachelor’s degree in Information Technology, Computer Science, or a related field.
• 3+ years of hands-on experience with Elastic Stack (ELK) in production.
• Strong knowledge of Logstash, particularly for ingesting and parsing logs from network appliances via syslog, NetFlow, or SNMP.
• Proficient in Linux administration and shell scripting (e.g., Bash).
• Familiar with containerization technologies like Docker and Kubernetes.
• Experience working with infrastructure, network, or security teams to support monitoring and incident response.