The opportunity
Elastic, the Search AI Company, enables everyone to find the answers they need in real time, using all their data, at scale — unleashing the potential of businesses and people. The Elastic Search AI Platform, used by more than 50% of the Fortune 500, brings together the…
What you'll do
Review and respond to alerts generated from our Elastic Detection Engine and other monitoring sources
Provide feedback to the Threat Detection team to improve the quality of: detections by identifying false positives, enrichment opportunities, and automated response possibilities
Conduct analysis on SIEM and/or endpoint logs during complex investigations
Develop and document innovative approaches to detect, respond to, and: eradicate advanced threats and improve overall time to respond
Identify additional integration points that would aid in event enrichment and: enable automated response activities
Gather additional context for security events
What they're looking for
- Identify the root cause of events and collaborate with teams to remediate any: identified control gaps or failures
- Oversee and coordinate response activities that span multiple teams and: products to ensure comprehensive remediation and sufficient mitigation of any identified gaps in security posture
- At least 3 years of experience related to security operations / incident: response in a complex, global environment. SaaS and cloud experience is a plus.
- Demonstrated ability to solve complex IT and security problems through log: and system analysis (Incident Response, SRE, System Administration). If you’ve done this with the help of the Elastic Stack, even better!
