Join Elastic's Security Architecture team to manage end-to-end security telemetry pipelines into Elasticsearch, maintain Elastic Cloud on Kubernetes clusters, handle ingest integrations with cloud/provider APIs, ensure data quality and ILM, and use Terraform, Helm, and Python for infrastructure and automation. Role based in Poland; compensation range provided in PLN.

Own end-to-end security telemetry ingestion into Elasticsearch (cloud provider audit logs, identity/SaaS activity, endpoint/asset data), maintain Elastic Cloud on Kubernetes clusters, manage pipelines, index templates and ILM, integrate with third‑party/cloud APIs, use Terraform, Kubernetes/Helm, Python scripting and AI automation to improve reliability and reduce toil. Preferred experience includes ECK/Elasticsearch on Kubernetes and familiarity with cloud providers (preferably GCP), SOC/IR workflows, and CI tooling.

Join the Security Architecture team to own end-to-end security telemetry ingestion into Elasticsearch, maintain Elastic Cloud on Kubernetes clusters, manage pipelines, index templates and ILM, and use Terraform, Kubernetes and Helm for deployments. The role requires Python scripting, API integrations, experience operating Elasticsearch in production, and applying AI/automation to improve reliability and reduce toil.

Join Elastic's Security EDR Workflows team to implement user-facing features and architectures for Elastic Defend and OSquery forensics, write production-grade code (TypeScript/Node.js and potentially other languages), collaborate with cross-functional and global teams, and apply AI-assisted development practices. Experience with Elastic Stack, cybersecurity/forensics, and open-source contributions are listed as bonuses.

Work on Elastic's Security EDR Workflows team to design and implement Elastic Defend management and response-action capabilities, OSquery forensics, and APIs. Responsibilities include building scalable, high-performance systems, owning reliability and observability, writing production-grade TypeScript/Node.js code, collaborating across security, product, and design teams, and using AI to improve development. Compensation listed as CAD 128,300–203,000 (base).

Join the Security EDR Workflows team to develop Elastic Defend policy, management and response-action features, collaborate with security engineering, product and design, and deliver scalable, high-performance systems using TypeScript/Node.js (and potentially other languages). Role involves OSquery forensics, Kibana integration, use of AI in development, and working with a globally distributed team. Location: Spain. Typical starting salary range: €55,800–€88,300 per year.

Work on Elastic's Security EDR Workflows team to design and implement policy configuration, response actions, and OSquery forensics capabilities for Elastic Defend. Implement user-facing features and scalable back-end systems using TypeScript/Node.js (and potentially other languages), collaborate with cross-functional and distributed teams, and apply AI-assisted development practices.

Join Elastic’s Security EDR Workflows team to implement user-facing workflows and management features for Elastic Defend, build response-actions and OSquery forensics, and develop scalable, high-performance systems. The role involves writing production-grade code (TypeScript/Node.js), collaborating with cross-functional and distributed teams, and using AI to improve development and engineering processes.

Join the Security EDR Workflows team to develop Elastic Defend management and response-action capabilities, OSquery forensics, and related workflows from the Kibana/UI side. Work involves writing production-grade code (TypeScript/Node.js and potentially other languages), contributing to architecture and scalable systems, collaborating across distributed security and product teams, and using AI to support development. Location: Ireland. Typical starting salary range: €72,800–€115,100 EUR per year.

Join Elastic's Security EDR Workflows team to implement user-facing features and backend frameworks for Elastic Defend and OSquery-based forensics. Work with TypeScript/Node.js (and potentially other languages), collaborate across security, product and design teams, and apply AI-assisted development to deliver scalable, high-performance security features used by practitioners worldwide.

Lead end-to-end delivery of Elastic Security projects (design, deploy, migrate) for customers including public sector, assess architectures and threat landscapes, build detections and ingestion pipelines, enable detection-as-code and Agentic AI features, collaborate with Sales/Engineering, and mentor other consultants. Requires 5+ years' experience, strong Elastic/SIEM and security expertise, scripting (Python), cloud and OS experience, and eligibility for national security screening where needed.

Senior Solutions Architect - SIEM role in the Netherlands to design and implement Elastic Security solutions, deliver POVs, support consultative selling and RFI/RFP responses, and improve incident response and SOC operations. Requires 7+ years of enterprise SIEM experience, knowledge of security architectures, SOC workflows, forensic analysis, behavioral analytics/ML, strong presentation skills, and willingness to travel ~30–50%. Typical OTE range €110,400–€174,600 EUR per year.

Join Elastic Security Endpoint Protections to research emerging attacker techniques and convert them into shipped protections. Responsibilities include instrumentation of endpoint telemetry, developing performant C/C++ production code for millions of endpoints, reverse engineering malware, owning efficacy end-to-end, extending protections across platforms, collaborating across distributed teams, mentoring, and publishing research. Requires 6+ years analyzing TTPs and building detections, 6+ years development in C/C++/Python, deep OS internals knowledge (Windows prioritized), and malware analysis experience.

Role requires 6+ years experience in attacker TTP analysis and building detections, 6+ years development in C, C++, and Python, deep OS internals and reverse-engineering skills, and experience developing performant, stable endpoint protections. Responsibilities include researching threats, adding endpoint visibility, writing production code, investigating telemetry at fleet scale, extending protections across platforms, mentoring, and publishing research. Salary range provided in CAD.

Lead and grow a distributed engineering team focused on endpoint protections (visibility, prevention, on-device ML) for Elastic Defend. Responsibilities include mentoring senior engineers, owning the roadmap and delivery, directing ML model work and telemetry, driving cross-platform protection parity (Windows, macOS, Linux), and representing the team in research and conferences. Requires hands-on security research, OS internals (kernel and user mode), malware analysis and reverse engineering experience, and people-leadership of senior technical contributors.

Senior Manager role responsible for leading and growing a globally distributed engineering team focused on endpoint protections (visibility, prevention, on-device machine learning) for Elastic Defend. The role requires hands-on background in security research, OS internals (kernel and user mode), reverse engineering and malware analysis, and experience mentoring senior engineers, owning roadmaps, and driving cross-platform protection parity. Compensation is base salary with a typical starting range of €80,400–€127,200 per year.

Elastic is hiring a Senior Security Research Engineer to research attacker techniques, build endpoint visibility and protections, reverse engineer malware, develop high-performance C/C++ production code, and lead technical initiatives. The role requires 6+ years of experience in TTP analysis and detection, development in C/C++/Python, deep OS internals knowledge (Windows prioritized), and malware/reverse-engineering expertise. Compensation is provided as base salary (USD range listed).

Drive the technical vision, architecture, and delivery of large-scale application networking systems (Ingress, private connectivity, DNS, security controls) for Elastic Cloud. Lead cross-organizational projects, own incident investigations and operational quality, mentor engineers, and partner with product and senior engineering stakeholders. Requires experience designing and operating cloud-native distributed systems and familiarity with Kubernetes networking and at least one major cloud provider.

Lead and grow a globally distributed engineering team responsible for endpoint visibility, prevention engines, and on-device machine learning for Elastic Defend. Own roadmap and delivery, direct machine learning and telemetry strategy, drive cross-platform protection parity, represent the team externally, and mentor senior research and engineering staff. Requires substantial hands-on security research experience, deep OS internals knowledge (kernel and user mode), reverse engineering and malware analysis skills, and people-leadership experience.

Lead design and implementation of a robust multi-cloud network and VDI architecture, including VPN/VDI deployments, Meraki and Aviatrix management, routing optimization, performance monitoring, and Zero Trust security controls. Requires 5+ years network engineering in multi-cloud environments and 3+ years with VPN and VDI technologies; includes security assessments, vulnerability scanning, documentation, and cross-functional collaboration.