Elastic Engineer at Dcoded, Remote, 12 Months, £450 per day

Senior Elastic SIEM/Security Consultant (Contract)

Remote | US Central Time | Long-term engagement | Outside IR35

We're supporting a client on a long-term Elastic Security programme and are looking to engage senior Elastic SIEM consultants with proven, real-world production experience.

This is a fully remote contract role, aligned to US Central Time, forming part of a wider Elastic Security delivery team. The engagement is expected to run for up to 2 years, full-time, with an initial project kick-off planned for mid-March (potentially sooner).

The role

You'll be working hands-on across a mature Elastic Security environment, contributing to SIEM delivery, detection engineering, and platform optimisation within a live production setting.

Key responsibilities

• Hands-on delivery across Elastic Security/Elastic SIEM in production environments
• Designing, building, and optimising detections, alerts, and tuning (ESQL, rule logic, noise reduction)
• Working with Cribl ingestion pipelines for data routing, enrichment, and optimisation
• Supporting and enhancing on-prem Elastic architectures
• Collaborating within a wider Elastic Security practice and delivery team
• Contributing to operational stability, performance, and detection maturity

Required experience

• Strong, hands-on Elastic Security/SIEM experience in real production environments
• Proven experience with Cribl for ingestion and pipeline management
• Solid detection engineering capability (ESQL, alerting, tuning)
• Experience working with on-prem Elastic stacks
• Background in long-running security or SIEM programmes (not just POCs or lab builds)

Nice to have

• Experience with ECK/Kubernetes
• Exposure to detection-as-code approaches (GitHub/GitLab)
• Experience working within large-scale or enterprise security teams

Additional information

• Fully remote role (aligned to US Central Time)
• Long-term contract (up to 2 years)
• Full-time engagement
• Interview process includes a discussion with the Elastic Security Practice

Please note: We're specifically looking to speak with consultants who have delivered production SIEM environments. This role is not suitable for candidates whose experience is limited to proofs of concept or demo-only work.