Elastic SIEM & SOC Security Engineer/Architect
First seen by Alion on Nov 5, 2026.
Permanent | UK remote with occasional client-site visits | Active SC/DV clearance required
Design it, then help build it. This is a hands-on architect role at a leading Elastic partner, shaping SIEM and SOC solutions for UK Defence and NATO environments. You won’t be handing over diagrams and walking away. You’ll own the architecture with the client and stay close to the delivery.
Why it’s worth a look
Join at a growth moment. The practice has just won major new projects and is expanding its permanent team, so this is a long-term role in a growing capability, not a single assignment.
Work with real specialists. You’ll be part of a team of 30+ SMEs delivering complex security and technology projects.
Serious, varied work. UK Defence, international NATO environments, and the chance to contribute to wider enterprise projects too.
Greenfield and rescue. Build new SIEM environments from scratch and turn around existing ones that need recovering.
Mostly remote. UK-based remote working, with some visits to client sites.
Your work counts more than your job title. They’ll judge you on what you’ve personally designed and delivered, not on what your last role was called.
No Elastic cert? You can still apply. If you meet the core clearance, architecture and Elastic requirements, a missing certification won’t rule you out.
What you’ll do
Depending on the engagement, you’ll:
Work directly with end clients to understand their technical, operational and security requirements
Design SOC and SIEM architectures built on Elastic/ELK
Turn those requirements into practical technical solutions
Guide implementation and delivery as the SME
Support greenfield SIEM implementations
Assess existing environments and help recover or improve them
Work alongside the established specialist SME team
Roll your sleeves up on technical delivery where it’s needed
Explain architectural decisions, technical risks and recommendations to client stakeholders
Help projects succeed in complex, security-sensitive environments
What you’ll bring
Current, active DV clearance
Strong SOC and/or SIEM architecture experience
Professional experience with Elastic/ELK
A track record of designing SIEM/SOC solutions or architectures
Clear evidence of what you’ve personally designed and delivered, including the scale, complexity and outcomes involved
Confidence working at SME/Architect level directly with end clients
Strong communication and stakeholder management skills
Experience in complex, security-sensitive environments
Bonus points for
A relevant Elastic certification
Hands-on Elastic engineering and implementation
Elasticsearch, Kibana and Logstash
Elastic Agent / Beats
SIEM implementation and optimisation
Troubleshooting or recovering existing Elastic environments
Wider SOC architecture and security tooling experience
A straightforward interview process
Three conversations, no surprises:
An initial chat about the role and whether it’s a good fit
A technical interview with the consultancy’s lead SIEM SME
A technical interview with a lead Defence SIEM SME
You’ll hear more about the organisation, team and projects as the process moves on, where appropriate.