The Elastic Security solution helps teams protect, investigate, and respond to threats before damage is done. On the Elastic Search AI Platform — and fueled by advanced analytics with years of data from across your attack surface — it eliminates data silos, automates prevention and detection, and streamlines investigation and response. The Elastic stack is widely used among the security analyst community, and our team is working to improve the user experience and workflows of these analysts. Exciting challenges await, including collecting data relevant to users, hosts, and cloud instances, aggregating and visualizing that data, providing insights into anomalous activity, and supporting the investigation phase of a Security Analyst workflow.
The team is diverse and distributed, but connected! You will be working remotely with some amazing Elasticians across the USA and Europe. We meet via Zoom, brainstorm in Google docs, discuss in open GitHub issues, and chat on Slack.
The Detection Engine team provides the core correlation and evaluation logic that powers detection rules and alerts. Their work ensures alerts are timely, relevant, and low-noise, giving analysts confidence in what they see.