{"id":3589041,"url":"https://alion.io/job/malomatia-edr-platform-engineer","title":"EDR Platform Engineer","company":{"id":1129,"name":"Malomatia","domain":"malomatia.com","url":"https://alion.io/company/malomatia","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Oracle","truth_index":{"grade":"A","score":96,"open_postings":10,"ghost_share":0,"stale_share":0.1,"repost_share":0.1,"time_to_fill_p50_days":37,"computed_at":"2026-11-02T06:13:15Z"}},"role":"DevOps","role_family":"DevOps","seniority":"middle","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Doha, Qatar"],"countries":["QA"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Amazon ECS","optional":false},{"name":"Ansible","optional":false},{"name":"Bash","optional":false},{"name":"DNS","optional":false},{"name":"Elastic SIEM","optional":false},{"name":"ElasticSearch","optional":false},{"name":"Git","optional":false},{"name":"Kibana","optional":false},{"name":"Linux","optional":false},{"name":"Logstash","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"SIEM","optional":false},{"name":"TCP/IP","optional":false},{"name":"Ubuntu","optional":false},{"name":"VMWare","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-11-01T12:24:10Z","employer_posted_date":"2026-11-01","last_verified_at":"2026-11-02T16:45:56Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"We are seeking an experienced EDR Platform Engineer-Elastic Security to administer, operate, maintain, and enhance an enterprise Elastic Security and Endpoint Detection & Response environment. The ideal candidate combines strong hands-on Elastic expertise with solid cybersecurity knowledge and advanced Linux administration and troubleshooting skills.\nEnsure the organization’s Elastic Security platform and endpoint protection infrastructure remain secure, stable, highly available, scalable, and operationally effective while continuously improving security visibility, detection capability, endpoint coverage, and incident-response readiness\n EDR Platform Administration - Elastic security\n Administer and maintain Elastic Security and Elastic Defend (EDR) environments.\n Deploy, configure, upgrade, and troubleshoot Elastic Agent on Linux and Windows endpoints.\n Manage Elastic Agent centrally through Fleet and Fleet Server, including agent policies, integrations, and endpoint policies.\n Monitor agent health, connectivity, policy status, telemetry, and data ingestion; troubleshoot offline, unhealthy, or degraded agents.\n Configure EDR prevention, detection, response, endpoint isolation, and other response capabilities.\n Manage large-scale EDR deployment across enterprise servers and workstations and execute upgrades with minimal disruption.\n Coordinate upgrades, patches, configuration changes, technical documentation, troubleshooting procedures, and operational run-books.\n Work closely with SOC analysts, infrastructure, network, systems, and cybersecurity teams; coordinate with vendors when escalation is required.\n Administer Elasticsearch clusters supporting Elastic Security and monitor cluster/node health, shard allocation, indexing, disk and resource utilization.\n Troubleshoot cluster, node, index, shard, authentication, authorization, connectivity, and performance issues.\n Manage index templates, component templates, data streams, ILM policies, retention, users, roles, privileges, API keys, and certificates.\n Administer Kibana and Elastic Security applications and support snapshot, restore, backup, and disaster-recovery procedures.\n Administer and troubleshoot Logstash pipelines, including inputs, filters, outputs, and data ingestion.\n Investigate delayed, dropped, duplicated events and identify ingestion bottlenecks.\n Work with Elastic Agent integrations, Beats, Syslog, APIs, ingest pipelines, ECS, and related parsing/normalization technologies.\n Configure, maintain, and tune Elastic Security detection rules to improve coverage and reduce false positives.\n Create custom detections based on organizational threats and use cases using KQL, EQL, ES|QL, and Elasticsearch Query DSL.\n Apply process whitelistingblock-listing following the best practice approach.\n Linux Administration - Core Requirement\nStrong Linux administration and troubleshooting capability is essential for this position.\n RHEL, Alma Linux, Ubuntu, or similar enterprise Linux distributions.\n Linux command-line administration, systemd/systemctl, journalctl, and operating-system log analysis.\n File systems, mounts, permissions, ownership, users, groups, sudo, and access controls.\n CPU, memory, disk, process, network, DNS, TCP/IP, SSH, and connectivity troubleshooting.\n Firewall administration, SELinux, RPM/YUM/DNF/APT package management, and Bash scripting (preferred)\n Ability to diagnose production issues directly from the Linux command line and perform structured root-cause analysis.\nTechnical Skills\nRequired\n Strong hands-on experience with Elastic Stack: Elasticsearch, Kibana, Elastic Security, Elastic Defend, Elastic Agent, Fleet/Fleet Server, and Logstash.\n Strong Linux administration and troubleshooting skills and good understanding of Windows endpoint security.\n Cybersecurity fundamentals, SIEM/EDR operations, security-event analysis, and incident-response management.\nPreferred\n Elastic Cloud Enterprise (ECE), distributed/multi-cluster Elastic architectures, high availability, and disaster recovery.\n Elasticsearch snapshot/restore, load balancers, reverse proxies, VMware or other virtualization platforms.\n Ansible or similar configuration-management tools, Git, REST APIs, and Python scripting.\nExperience & Education\n Approximately 3-5+ years of experience in cybersecurity, security engineering, infrastructure security, SIEM, EDR, or related technical roles.\n Hands-on production experience administering Elastic Stack environments and troubleshooting complex Linux-based systems.\n Experience operating EDR or endpoint-security technologies in enterprise and high-availability and critical infrastructure environment.\n Bachelor’s degree in Information Technology, Computer Engineering, Information Security or equivalent professional experience.\n Candidates with strong Elastic and Linux expertise but fewer total years of experience may also be considered.\nPreferred Certifications\n Elastic Certified Engineer, Elastic Certified Analyst, or relevant Elastic certification (preferred)\n RHCSA / RHCE.\n CompTIA Security+ / CySA+ or equivalent certification\n GIAC, CISSP, or equivalent security certification (preferred)\nKey Competencies\n Strong technical troubleshooting, analytical thinking, and structured root-cause analysis.\n Ability to troubleshoot across endpoint, network, operating-system, ingestion, and Elasticsearch layers.\n Ability to work effectively during critical production infrastructure and communicate clearly with technical and non-technical stakeholders.\n Strong documentation skills and ability to work independently and collaboratively across technical teams.","description_format":"text","description_chars":5669,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","IT Consulting & Digital Transformation","Systems Integrators","Call Center Services"],"lifecycle":[{"event":"open","at":"2026-11-01T16:03:11Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":0,"expected_fill_days":37,"reasons":["conf:4","velocity","win:early"],"computed_at":"2026-11-02T06:13:15Z"},"pay":null,"html_url":"https://alion.io/job/malomatia-edr-platform-engineer","json_url":"https://alion.io/job/malomatia-edr-platform-engineer.json","meta":{"generated_at":"2026-11-02T21:52:29Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":30613,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-03T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1129},"rest":"https://alion.io/mcp/rest/get_company?id=1129"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fmalomatia-edr-platform-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fmalomatia-edr-platform-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fmalomatia-edr-platform-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/malomatia-edr-platform-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fmalomatia-edr-platform-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3589041}},{"tool":"search_jobs","arguments":{"company":"malomatia.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3589041},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}