Senior Elastic Security & Detection Engineer (SIEM)

Role overview

Elastic platform engineering

• Administer, maintain, and optimize Elastic Stack infrastructure and Elasticsearch clusters.
• Design scalable ingestion pipelines using Logstash, Beats, and Elastic Agent.
• Tune Elasticsearch performance, manage index lifecycles, monitor cluster health, and troubleshoot.
• Develop Kibana dashboards, visualizations, and operational reporting.

Detection engineering

• Design, develop, test, and maintain high-fidelity Elastic Security detection use cases.
• Create MITRE ATT&CK-aligned content, correlation rules, behavioral analytics, anomaly detection, and advanced threat detection logic.
• Improve detection coverage while reducing false positives; assess gaps and implement monitoring capabilities.
• Partner with SOC analysts and threat hunters to operationalize threat intelligence and emerging attack techniques.

Threat hunting and security content

• Conduct proactive threat hunting and support incident investigations through log analysis, event correlation, and forensic review.
• Assist with root cause analysis and preventive detections; recommend visibility improvements across endpoint, network, cloud, and application environments.
• Develop dashboards, reports, alerts, and monitoring content; onboard, normalize, and enrich log sources.
• Create operational documentation, runbooks, and detection engineering standards.

Required qualifications

• Bachelor’s degree in computer science, information technology, cybersecurity, or a related field.
• Five to eight years of experience in cybersecurity, SIEM engineering, detection engineering, or security operations.
• Hands-on Elastic Stack experience, including Elasticsearch, Kibana, Logstash, Beats, Elastic Agent, and Elastic Security SIEM.
• Experience managing large-scale Elasticsearch clusters; strong understanding of KQL, Lucene, and Elasticsearch Query DSL.
• Experience developing detection rules and behavioral analytics; knowledge of MITRE ATT&CK, Cyber Kill Chain, and detection engineering practices.
• Experience in threat hunting, incident investigation, and security monitoring; understanding of Windows, Linux, Active Directory, cloud, and network security logs.
• Strong analytical and problem-solving skills, with ability to work independently and collaboratively.

Preferred skills and certifications

• Other SIEM experience, such as Splunk, is preferred.
• The posting lists Elastic Certified Engineer, Elastic Certified Observability Engineer, Elastic Certified Analyst, Elastic Security certifications, CompTIA Security+, GIAC certifications, and CISSP; GIAC certifications and CISSP are marked preferred.

Salary

• The description states AED 20,000–21,0000 per month; the structured salary field states AED 20,000–210,000 per month.