Security Engineer – Endpoint Detection & Response (Elastic EDR)

About the role

Core42 is looking for a Security Engineer specialized in Endpoint Detection & Response (EDR) using the Elastic Security platform. You will design, deploy and maintain Elastic‑based EDR solutions to protect the organisation’s enterprise environment and support incident response activities.

Key responsibilities

• Design, configure and operate Elastic EDR infrastructure and endpoint agents.
• Manage the Elastic Agent lifecycle, including deployment, upgrades, troubleshooting and policy enforcement.
• Develop and maintain detection rules, security use cases and behavioural analytics within Elastic Security.
• Integrate Elastic EDR with SIEM, SOAR, IAM, vulnerability management and threat intelligence tools.
• Ensure platform high‑availability, scalability, performance and compliance with security standards.
• Collaborate with Security Operations, Incident Response, Platform Engineering, Infrastructure and Compliance teams.

Required profile

• Minimum 5 years of hands‑on experience in endpoint security and EDR engineering.
• Strong knowledge of Elastic Stack components (Elasticsearch, Kibana, Elastic Agent, Elastic Defend).
• Proven ability to develop detection rules and conduct threat hunting.
• Experience integrating security tools and maintaining high‑availability environments.

Required skills

• Detection rule engineering
• Elastic Defend
• Elastic Agent
• Elastic Security
• Windows security
• Endpoint Security
• Kibana
• Log Analysis
• Threat Hunting
• Linux Security
• Bash Scripting
• Malware Analysis
• Incident Response
• Elasticsearch
• Python