About this role
Elastic, the Search AI Company, enables everyone to find the answers they need in real time, using all their data, at scale — unleashing the potential of businesses and people. The Elastic Search AI Platform, used by more than 50% of the Fortune 500, brings together the precision of search and the intelligence of AI to enable everyone to accelerate the results that matter. By taking advantage of all structured and unstructured data — securing and protecting private information more effectively — Elastic’s complete, cloud-based solutions for search, security, and observability help organizations deliver on the promise of AI.
What is The Role
You'll build and own the capabilities that get security telemetry into Elastic from lightweight host agents (Beats) collecting endpoint, network, and event data, to Elastic managed integrations extracting from hundreds of third-party SaaS, cloud, and security-vendor APIs. Your work spans two of Elastic's most-used open-source repositories (elastic/beats and elastic/integrations) and directly powers the data foundation of Elastic Security (SIEM). This team owns the full ingestion surface: on-host collectors, the shared input framework, and the vendor integration catalog.
What You Will Be Doing
• Design, build, and maintain Beats data shippers, Filebeat inputs and modules, plus host/endpoint collectors such as Auditbeat, Winlogbeat, Packetbeat, and Osquerybeat in Go.
• Develop and maintain security integration packages for third-party sources (identity/IdP, EDR/XDR, email security, firewalls, cloud security, threat intel, vulnerability management).
• Build robust Elastic managed/API-based collection against external vendor and cloud-provider APIs (AWS, Azure, GCP), handling auth (OAuth2, tokens), pagination, rate limits, and resilience .
• Improve reliability, performance, and observability of collection at scale; own quality for your areas and drive down failing-test and reliability noise.
• Review community and partner contributions, mentor engineers, and set technical direction across the ingestion surface.
• Collaborate with product, security research, and field teams to prioritize high-impact sources and unblock customer onboarding.
• Apply LLMs and AI automation to ease and accelerate the work e.g. scaffolding new integrations/modules, drafting and normalizing ECS mappings and ingest pipelines, generating parsers and tests from sample data, summarizing vendor API docs, and triaging failing-test and reliability noise.
• Build and improve internal AI-assisted tooling and automation (scripts, agents, CI steps) that reduce toil across a large catalog, and establish good practices for using AI safely and effectively (review, validation, guarding against hallucinated mappings).
What You Bring
• 5+ years of software engineering experience building production backend/data systems. Solid proficiency in Go (or robust systems-language experience with a track record of ramping