Elastic SIEM Architect (Design, Implementation & Deployment)

Role Overview

Lead the architecture, design, and deployment of a large-scale, multi-tenant Elastic SIEM platform on GCP, supporting Central Logging Service (CLS) and Event Correlation & Behaviour Analytics (ECBA).

Key Responsibilities

• Design scalable, multi-cluster Elastic architecture for high EPS environments
• Define data ingestion pipelines (EDC, GCP, SaaS, network, endpoint)
• Develop data lifecycle strategy (hot/warm/cold/archive tiers)
• Implement tenant isolation and RBAC models
• Design and deploy cross-cluster search (CCS) and replication (CCR)
• Integrate Elastic with:
  • SOAR
  • Network visibility Tools
  • External systems (EDR, identity, firewalls)
• Ensure HA, DR, backup, and failover capabilities
• Optimize for performance, scale, and cost efficiency
• Support SA&A, security, and compliance requirements
• Collaborate with GCP, XSOAR, and network teams

Required Skills

• Deep expertise in Elasticsearch / Elastic Stack
• Strong knowledge of log pipelines and data engineering
• Experience with multi-tenant SIEM architectures
• Understanding of security detection frameworks (MITRE ATT&CK)
• Experience with cloud platforms (GCP preferred)
• Strong troubleshooting and performance tuning skills

Ideal Candidate Experience

• 7–10+ years in SIEM / Security Engineering / Architecture
• Proven experience with large-scale Elastic deployments (high EPS)
• Experience with multi-cluster architectures (Cross-Cluster Search (CCS), Cross-Cluster Replication (CCR), Index Lifecycle Management (ILM))
• Hands-on with Elastic Agent / Beats / ingestion pipelines
• Experience designing multi-tenant SOC platforms
• Background in regulated environments
• Familiarity with SOC operations and detection engineering
• Experience with distributed systems and HA/DR design

ACCESSIBILITY

We’re committed to fostering an inclusive, equitable, and accessible workplace where every team member feels valued, respected, and supported, and has the opportunity to reach their full potential. We welcome and encourage applications from people with disabilities.

Accommodations are available on request for candidates taking part in all aspects of the selection process. For a confidential inquiry, simply email your recruiter directly or accessibility@fxinnovation.com to make arrangements.

If you have questions regarding accessible employment at Ateko please email our Human Resources team at accessibility@fxinnovation.com

Ateko

Derek Weber - Senior Recruiter

derek.weber@ateko.com