ELK Engineer – L2 Experience: 3–6 Years Role Level: L2 / Mid-Level Engineer Domain: ELK / SIEM / Log Management / Platform Engineering Role Summary We are looking for a hands-on ELK Engineer – L2 to manage, troubleshoot, optimize, and support Elasticsearch-based SIEM/log-management environments. The engineer will independently handle complex ELK issues, platform performance, log ingestion, cluster management, and production stability. Key Responsibilities • Install, configure, administer, upgrade, and troubleshoot Elasticsearch, Logstash and ProAct environments. • Manage Elasticsearch clusters, nodes, indices, shards, replicas, mappings, templates and ILM policies. • Monitor and optimize JVM/heap, CPU, memory, disk utilization, indexing and search performance. • Troubleshoot cluster health, unassigned shards, disk watermark, indexing failures, mapping conflicts and performance degradation. • Develop, enhance and troubleshoot Logstash pipelines, Grok/Dissect patterns and ECS mappings. • Diagnose log loss, ingestion delays, parsing failures, pipeline-routing and data-quality issues. • Support ingestion through Elastic Agent/Filebeat, Syslog, APIs, Kafka and Redis. • Perform capacity planning and optimize storage, retention, shards, indices and pipeline throughput. • Manage backup, snapshot, restore and DR/recovery readiness. • Configure and troubleshoot Kibana dashboards, visualizations, data views and access-related issues. • Perform RCA for P1/P2 and recurring platform issues and drive permanent corrective actions. • Build scripts/automation for health checks, monitoring, deployment and repetitive operational activities. • Maintain SOPs, KEDB, troubleshooting guides and technical documentation. • Provide technical guidance and KT to L1 engineers and independently coordinate complex issues with Product/Engineering teams. Required Technical Skills Must Have: Elasticsearch, Logstash, Kibana, Linux, Grok/Regex, ECS, cluster management, shards/indices, ILM, JVM/heap, performance tuning and troubleshooting. Good to Have: Elastic Agent/Filebeat, Kafka, Redis, Python/Shell scripting, REST APIs, Git, SQL, AWS/Azure/GCP, SIEM and cybersecurity fundamentals. Expected L2 Competency The candidate should independently manage and troubleshoot an end-to-end ELK environment, from log ingestion and parsing through Elasticsearch indexing, storage and visualization. The engineer should be capable of handling production incidents, RCA, cluster optimization, capacity/performance issues and complex ingestion problems with minimal dependency on senior engineers. Key Success Measures • ELK platform availability and stability • Reduced P1/P2 incidents and faster MTTR • Cluster and storage optimization • Minimal log loss and ingestion delay • Improved indexing and search performance • Reduction in recurring issues through RCA and automation • Quality of SOP/KEDB and knowledge transfer