Key Skills

Job Description

Role overview The Ministry of Defence is looking for Medior and Senior Elastic Engineers to join a dedicated technical team supporting the Koninklijke Marechaussee (Royal Netherlands Marechaussee). The team is responsible for maintaining, improving and expanding an Elastic Stack-based security monitoring platform. The platform automatically analyses system logs to identify unusual, risky or potentially unauthorised activities across military police and police information systems. The successful candidates will help develop the platform, integrate additional applications and log sources, improve security detection capabilities and ensure reliable data processing. Key responsibilities Maintain and administer the Elastic Stack platform, including Elasticsearch, Kibana, Logstash and Elastic Agent. Develop and maintain ingest pipelines, parsers and data mappings using Elastic Common Schema (ECS). Integrate new and non-standard log sources, including legacy systems and network devices. Develop, optimise and fine-tune security detection rules. Support SOC analysts with second-line technical support. Troubleshoot data ingestion, parsing errors and platform performance issues. Monitor and optimise Elastic clusters, Fleet, Elastic Agent and index lifecycle management. Automate platform configuration and operational processes. Document parsers, pipelines, configurations and technical changes. Collaborate with architects, engineers, product owners and other technical specialists in a SAFe Agile environment. Essential requirements Minimum 2 years of demonstrable relevant professional experience. Practical experience with Elastic Stack: Elasticsearch Kibana Logstash Elastic Agent / Fleet Knowledge of Elastic Common Schema (ECS). Experience developing ingest pipelines using Grok and Dissect. Experience onboarding custom and non-standard log sources. Knowledge of SIEM detection rules and tuning. Experience with KQL and EQL; Sigma is advantageous. Experience with Linux and Windows logging. Scripting and automation experience using tools such as: Terraform Ansible Python Bash PowerShell Desirable experience Detection-as-Code and Git/CI/CD. Air-gapped or classified environments. MITRE ATT&CK framework. Kafka implementations. Service-oriented architecture. Elastic Certified Analyst or Elastic Certified Observability Engineer. Experience within government or defence environments. SAFe, Scrum or other Agile methodologies. Linux, Open Source and Storage technologies.

Core Responsibilities

Maintain, improve, and expand the Elastic Stack security monitoring platform, including its data ingestion, parsing, detection rules, and cluster performance. Integrate new log sources, support SOC analysts, automate and document platform operations, and collaborate with technical teams in a SAFe Agile environment.

Requirements

Candidates must have at least two years of relevant professional experience, practical Elastic Stack experience, and knowledge of ECS, ingest pipelines, custom log sources, and SIEM detection tuning. They should also have experience with KQL and EQL, Linux and Windows logging, and scripting or automation; Sigma, Detection-as-Code, classified environments, and relevant certifications are advantageous.