Overview As Sr. Elastic Defend Architect, you will design and deploy Elastic Defend and Elastic Security across large, distributed environments for a federal cybersecurity program. You will work with cross-functional teams to build scalable Elastic Security architectures and high performance Elasticsearch deployments that support threat detection and incident response. You'll optimize ingestion, observability, and real-time monitoring to enable proactive defense and rapid incident handling. This role offers a mission critical impact in a leading MSSP with on site collaboration.
Compensation / Benefits- Medical
- Dental
- Vision
- 401K
- PTO
- Sick Leave (as required)
Responsibilities- Architect and deploy Elastic Defend across large, distributed enterprise environments
- Configure Fleet Servers, enrollment workflows, endpoint policies, and security integrations
- Design and maintain scalable Elasticsearch clusters for Elastic Security workloads
- Build and optimize ingestion pipelines for endpoint telemetry, logs, alerts, and security data
- Improve Elastic Security performance via ILM tuning, ECS mapping, and ingest pipeline enhancements
- Develop observability frameworks using Kibana and related tooling
- Implement logging, metrics, and tracing for real time monitoring and detection
- Analyze datasets for threat hunting, anomaly detection, and operational insights
- Troubleshoot Elastic Defend agent behavior, endpoint policy issues, and integration failures
- Ensure data integrity, security, and compliance across Elastic Security components
- Collaborate with SOC, IR, DevOps, cloud, and platform engineering teams
- Mentor and share SME knowledge with internal teams and stakeholders
- Document architectures, runbooks, deployment patterns, and best practices
- Stay current on Elastic Security capabilities and endpoint threat trends
Key requirements- Active Secret clearance (minimum)
- Valid U.S. Passport
- Outstanding written and verbal communication skills
- Willingness to travel on-site domestically or internationally as needed
- Experience with Elastic Security / Elastic Defend architecture or administration
- Elasticsearch cluster design, scaling, and performance optimization
- SIEM and EDR concepts across Elastic, Splunk, QRadar, LogRhythm, or Sentinel
- Linux/Unix, networking fundamentals, and cloud environments (AWS, Azure, GCP)
- Scripting: Python, PowerShell, or Bash
- Knowledge of modern threat landscapes, endpoint techniques, and defensive controls
- Strong communication (written and verbal)
- Cross functional collaboration
- Mentoring and knowledge sharing
- Elastic Defend / Elastic Security architecture
- Elasticsearch cluster design, scaling, performance optimization
- SIEM/EDR concepts across major platforms
