EDR Platform Engineer (Qatar) Doha

Requirements

Candidates must have 3-5 years of experience in cybersecurity or security engineering with strong hands-on expertise in the Elastic Stack. Advanced Linux administration and troubleshooting skills are essential for this role.

Job Summary

We are seeking an experienced EDR Platform Engineer-Elastic Security to
administer, operate, maintain, and enhance an enterprise Elastic Security and
Endpoint Detection & Response environment. The ideal candidate combines strong
hands-on Elastic expertise with solid cybersecurity knowledge and advanced Linux
administration and troubleshooting skills.

Ensure the organization’s Elastic Security platform and endpoint protection
infrastructure remain secure, stable, highly available, scalable, and
operationally effective while continuously improving security visibility,
detection capability, endpoint coverage, and incident-response readiness

RESPONSIBILITIES

EDR Platform Administration – Elastic security

 Administer and maintain Elastic Security and Elastic Defend (EDR)
environments.
 Deploy, configure, upgrade, and troubleshoot Elastic Agent on Linux and
Windows endpoints.
 Manage Elastic Agent centrally through Fleet and Fleet Server, including agent
policies, integrations, and endpoint policies.
 Monitor agent health, connectivity, policy status, telemetry, and data
ingestion; troubleshoot offline, unhealthy, or degraded agents.
 Configure EDR prevention, detection, response, endpoint isolation, and other
response capabilities.
 Manage large-scale EDR deployment across enterprise servers and workstations
and execute upgrades with minimal disruption.
 Coordinate upgrades, patches, configuration changes, technical documentation,
troubleshooting procedures, and operational run-books.
 Work closely with SOC analysts, infrastructure, network, systems, and
cybersecurity teams; coordinate with vendors when escalation is required.
 Administer Elasticsearch clusters supporting Elastic Security and monitor
cluster/node health, shard allocation, indexing, disk and resource utilization.
 Troubleshoot cluster, node, index, shard, authentication, authorization,
connectivity, and performance issues.
 Manage index templates, component templates, data streams, ILM policies,
retention, users, roles, privileges, API keys, and certificates.
 Administer Kibana and Elastic Security applications and support snapshot,
restore, backup, and disaster-recovery procedures.
 Administer and troubleshoot Logstash pipelines, including inputs, filters,
outputs, and data ingestion.
 Investigate delayed, dropped, duplicated events and identify ingestion
bottlenecks.
 Work with Elastic Agent integrations, Beats, Syslog, APIs, ingest pipelines,
ECS, and related parsing/normalization technologies.
 Configure, maintain, and tune Elastic Security detection rules to improve
coverage and reduce false positives.
 Create custom detections based on organizational threats and use cases using
KQL, EQL, ES|QL, and Elasticsearch Query DSL.
 Apply process whitelistingblock-listing following the best practice approach.

QUALIFICATIONS

Linux Administration – Core Requirement

Strong Linux administration and troubleshooting capability is essential for this
position.
 RHEL, Alma Linux, Ubuntu, or similar enterprise Linux distributions.
 Linux command-line administration, systemd/systemctl, journalctl, and
operating-system log analysis.
 File systems, mounts, permissions, ownership, users, groups, sudo, and access
controls.
 CPU, memory, disk, process, network, DNS, TCP/IP, SSH, and connectivity
troubleshooting.
 Firewall administration, SELinux, RPM/YUM/DNF/APT package management, and Bash
scripting (preferred)
 Ability to diagnose production issues directly from the Linux command line and
perform structured root-cause analysis.

Technical Skills

Required
 Strong hands-on experience with Elastic Stack: Elasticsearch, Kibana, Elastic
Security, Elastic Defend, Elastic Agent, Fleet/Fleet Server, and Logstash.
 Strong Linux administration and troubleshooting skills and good understanding
of Windows endpoint security.
 Cybersecurity fundamentals, SIEM/EDR operations, security-event analysis, and
incident-response management.

Preferred
 Elastic Cloud Enterprise (ECE), distributed/multi-cluster Elastic
architectures, high availability, and disaster recovery.
 Elasticsearch snapshot/restore, load balancers, reverse proxies, VMware or
other virtualization platforms.
 Ansible or similar configuration-management tools, Git, REST APIs, and Python
scripting.

Experience & Education

 Approximately 3–5+ years of experience in cybersecurity, security engineering,
infrastructure security, SIEM, EDR, or related technical roles.
 Hands-on production experience administering Elastic Stack environments and
troubleshooting complex Linux-based systems.
 Experience operating EDR or endpoint-security technologies in enterprise and
high-availability and critical infrastructure environment.
 Bachelor’s degree in Information Technology, Computer Engineering, Information
Security or equivalent professional experience.
 Candidates with strong Elastic and Linux expertise but fewer total years of
experience may also be considered.

Preferred Certifications
 Elastic Certified Engineer, Elastic Certified Analyst, or relevant Elastic
certification (preferred)
 RHCSA / RHCE.
 CompTIA Security+ / CySA+ or equivalent certification
 GIAC, CISSP, or equivalent security certification (preferred)
Key Competencies
 Strong technical troubleshooting, analytical thinking, and structured
root-cause analysis.
 Ability to troubleshoot across endpoint, network, operating-system, ingestion,
and Elasticsearch layers.
 Ability to work effectively during critical production infrastructure and
communicate clearly with technical and non-technical stakeholders.
 Strong documentation skills and ability to work independently and
collaboratively across technical teams.

Responsibilities

The EDR Platform Engineer will administer, maintain, and enhance the enterprise Elastic Security and EDR environment. Responsibilities include deploying and troubleshooting Elastic Agents, managing Elasticsearch clusters, and configuring detection rules to improve security visibility.

We are a job aggregator. All rights belong to the original company or recruiter. We do not claim ownership of any listings.