Security Platform Engineer (DevSecOps)

About the role

ECI is the leading global provider of managed services, cybersecurity, and business transformation for mid-market financial services organizations across the globe. From its unmatched range of services, ECI provides stability, security and improved business performance, freeing clients from technology concerns and enabling them to focus on running their businesses. More than 1,000 customers worldwide with over $3 trillion of assets under management put their trust in ECI. At ECI, we believe success is driven by passion and purpose. Our passion for technology is only surpassed by our commitment to empowering our employees around the world.

The Security Platform Engineer is part of ECI's Security Engineering team and focuses on building, operating, and improving the platform layer that powers security services at scale. This is a hands-on engineering role with strong emphasis on Elastic platform operations, telemetry pipeline reliability, and lifecycle management. You will design and maintain data ingestion patterns, platform standards, and operational controls that ensure security data is reliable, performant, and ready for detection and response use. As part of our modern engineering approach, this role uses AI-assisted workflows to improve delivery quality, reduce repetitive operational effort, and accelerate security outcomes across detection, response, and platform services. You will work within the Platform function, where your focus is owning Elastic, Logstash, and core data pipeline operations across client environments. You will partner closely with Automation Engineering, which is accountable for detection-as-code workflows, SOAR orchestration, and automation delivery that runs on top of the platform. In practice, this means Platform owns data ingestion, parsing standards, schema quality, retention, and platform reliability, while Automation owns how workflows and detection logic are engineered, tested, deployed, and maintained.

Responsibilities

• Build and maintain Elastic platform services, data pipelines, and operational standards across security environments.
• Own Logstash and ingestion pipeline lifecycle including onboarding, parsing, normalization, enrichment, and schema governance.
• Maintain platform reliability through performance tuning, capacity planning, retention management, and upgrade planning.
• Define and enforce data quality standards to ensure telemetry is complete, consistent, and usable for detection and response workflows.
• Troubleshoot and resolve ingestion, indexing, search performance, and pipeline stability issues in production environments.
• Own platform-side client lifecycle readiness including onboarding standards, technical validation, and production go-live criteria.
• Build and maintain platform observability using metrics, logging, health checks, and operational runbooks.
• Partner with Automation Engineering to provide stable data contracts and platform interfaces for detection and workflow delivery.
• Collaborate in architecture and operational review practices to raise engineering standards across the function.
• Explore and apply AI-assisted engineering practices to improve platform reliability, telemetry quality, operational documentation, and delivery efficiency.

Requirements

• Degree in Computer Science, Cyber Security, Engineering, Information Technology, or equivalent practical experience.
• 3+ years supporting or engineering production SIEM, observability, or large-scale data platform environments.
• Strong understanding of telemetry ingestion, parsing, normalization, enrichment, and schema management.
• Experience troubleshooting distributed platform issues across ingestion, indexing, search, and data lifecycle.
• Practical experience with platform lifecycle operations including upgrades, patching, configuration management, and performance tuning.
• Experience working with REST APIs and integration patterns in operational environments.
• Working knowledge of Linux administration in engineering environments.
• Working knowledge of cloud platforms and services, including IAM, networking, and