Elastic SIEM & SOC Security Engineer/Architect

Permanent | UK remote with occasional client-site visits | Active SC/DV clearance required

Design it, then help build it. This is a hands-on architect role at a leading Elastic partner, shaping SIEM and SOC solutions for UK Defence and NATO environments. You won’t be handing over diagrams and walking away. You’ll own the architecture with the client and stay close to the delivery.

Why it’s worth a look

• Join at a growth moment. The practice has just won major new projects and is expanding its permanent team, so this is a long-term role in a growing capability, not a single assignment.

• Work with real specialists. You’ll be part of a team of 30+ SMEs delivering complex security and technology projects.

• Serious, varied work. UK Defence, international NATO environments, and the chance to contribute to wider enterprise projects too.

• Greenfield and rescue. Build new SIEM environments from scratch and turn around existing ones that need recovering.

• Mostly remote. UK-based remote working, with some visits to client sites.

• Your work counts more than your job title. They’ll judge you on what you’ve personally designed and delivered, not on what your last role was called.

• No Elastic cert? You can still apply. If you meet the core clearance, architecture and Elastic requirements, a missing certification won’t rule you out.

What you’ll do

Depending on the engagement, you’ll:

• Work directly with end clients to understand their technical, operational and security requirements

• Design SOC and SIEM architectures built on Elastic/ELK

• Turn those requirements into practical technical solutions

• Guide implementation and delivery as the SME

• Support greenfield SIEM implementations

• Assess existing environments and help recover or improve them

• Work alongside the established specialist SME team

• Roll your sleeves up on technical delivery where it’s needed

• Explain architectural decisions, technical risks and recommendations to client stakeholders

• Help projects succeed in complex, security-sensitive environments

What you’ll bring

• Current, active DV clearance

• Strong SOC and/or SIEM architecture experience

• Professional experience with Elastic/ELK

• A track record of designing SIEM/SOC solutions or architectures

• Clear evidence of what you’ve personally designed and delivered, including the scale, complexity and outcomes involved

• Confidence working at SME/Architect level directly with end clients

• Strong communication and stakeholder management skills

• Experience in complex, security-sensitive environments

Bonus points for

• A relevant Elastic certification

• Hands-on Elastic engineering and implementation

• Elasticsearch, Kibana and Logstash

• Elastic Agent / Beats

• SIEM implementation and optimisation

• Troubleshooting or recovering existing Elastic environments

• Wider SOC architecture and security tooling experience

A straightforward interview process

Three conversations, no surprises:

1. An initial chat about the role and whether it’s a good fit

2. A technical interview with the consultancy’s lead SIEM SME

3. A technical interview with a lead Defence SIEM SME

You’ll hear more about the organisation, team and projects as the process moves on, where appropriate.