EDR Platform Engineer

About the Role
We are seeking an experienced EDR Platform Engineer-Elastic Security to administer, operate, maintain, and enhance an enterprise Elastic Security and Endpoint Detection & Response environment. The ideal candidate combines strong hands-on Elastic expertise with solid cybersecurity knowledge and advanced Linux administration and troubleshooting skills.
Ensure the organization’s Elastic Security platform and endpoint protection infrastructure remain secure, stable, highly available, scalable, and operationally effective while continuously improving security visibility, detection capability, endpoint coverage, and incident-response readiness.

Responsibilities
EDR Platform Administration – Elastic Security

• Administer and maintain Elastic Security and Elastic Defend (EDR) environments.
• Deploy, configure, upgrade, and troubleshoot Elastic Agent on Linux and Windows endpoints.
• Manage Elastic Agent centrally through Fleet and Fleet Server, including agent policies, integrations, and endpoint policies.
• Monitor agent health, connectivity, policy status, telemetry, and data ingestion; troubleshoot offline, unhealthy, or degraded agents.
• Configure EDR prevention, detection, response, endpoint isolation, and other response capabilities.
• Manage large-scale EDR deployment across enterprise servers and workstations and execute upgrades with minimal disruption.
• Coordinate upgrades, patches, configuration changes, technical documentation, troubleshooting procedures, and operational run-books.
• Work closely with SOC analysts, infrastructure, network, systems, and cybersecurity teams; coordinate with vendors when escalation is required.
• Administer Elasticsearch clusters supporting Elastic Security and monitor cluster/node health, shard allocation, indexing, disk and resource utilization.
• Troubleshoot cluster, node, index, shard, authentication, authorization, connectivity, and performance issues.
• Manage index templates, component templates, data streams, ILM policies, retention, users, roles, privileges, API keys, and certificates.
• Administer Kibana and Elastic Security applications and support snapshot, restore, backup, and disaster-recovery procedures.
• Administer and troubleshoot Logstash pipelines, including inputs, filters, outputs, and data ingestion.
• Investigate delayed, dropped, duplicated events and identify ingestion bottlenecks.
• Work with Elastic Agent integrations, Beats, Syslog, APIs, ingest pipelines, ECS, and related parsing/normalization technologies.
• Configure, maintain, and tune Elastic Security detection rules to improve coverage and reduce false positives.
• Create custom detections based on organizational threats and use cases using KQL, EQL, ES|QL, and Elasticsearch Query DSL.
• Apply process whitelisting/block-listing following the best practice approach.

Qualifications
Linux Administration – Core Requirement
Strong Linux administration and troubleshooting capability is essential for this position.

• RHEL, Alma Linux, Ubuntu, or similar enterprise Linux distributions.
• Linux command-line administration, systemd/systemctl, journalctl, and operating-system log analysis.
• File systems, mounts, permissions, ownership, users, groups, sudo, and access controls.
• CPU, memory, disk, process, network, DNS, TCP/IP, SSH, and connectivity troubleshooting.
• Firewall administration, SELinux, RPM/YUM/DNF/APT package management, and Bash scripting (preferred).
• Ability to diagnose production issues directly from the Linux command line and perform structured root-cause analysis.

Technical Skills
Required

• Strong hands-on experience with Elastic Stack: Elasticsearch, Kibana, Elastic Security, Elastic Defend, Elastic Agent, Fleet/Fleet Server, and Logstash.
• Strong Linux administration and troubleshooting skills and good understanding of Windows endpoint security.
• Cybersecurity fundamentals, SIEM/EDR operations, security-event analysis, and incident-response management.

Preferred

• Elastic Cloud Enterprise (ECE), distributed/multi-cluster Elastic architectures, high availability, and disaster recovery.
• Elasticsearch snapshot/restore, load balancers, reverse proxies, VMware or other virtualization platforms.
• Ansible or similar configuration-management tools, Git, REST APIs, and Python scripting.

Experience & Education

• Approximately 3–5+ years of experience in cybersecurity, security engineering, infrastructure security, SIEM, EDR, or related technical roles.
• Hands-on production experience administering Elastic Stack environments and troubleshooting complex Linux-based systems.
• Experience operating EDR or endpoint-security technologies in enterprise and high-availability and critical infrastructure environments.
• Bachelor’s degree in Information Technology, Computer Engineering, Information Security or equivalent professional experience.
• Candidates with strong Elastic and Linux expertise but fewer total years of experience may also be considered.

Preferred Certifications

• Elastic Certified Engineer, Elastic Certified Analyst, or relevant Elastic certification (preferred).
• RHCSA / RHCE.
• CompTIA Security+ / CySA+ or equivalent certification.
• GIAC, CISSP, or equivalent security certification (preferred).

Key Competencies

• Strong technical troubleshooting, analytical thinking, and structured root-cause analysis.
• Ability to troubleshoot across endpoint, network, operating-system, ingestion, and Elasticsearch layers.
• Ability to work effectively during critical production infrastructure and communicate clearly with technical and non-technical stakeholders.
• Strong documentation skills and ability to work independently and collaboratively across technical teams.