Hands-on experience architecting, deploying, and maintaining Elastic Stack (Elasticsearch, Logstash, Kibana, Elastic Agent/Fleet/Defend) in a production environment, or similar experience performing advanced SIEM engineering duties in another enterprise SIEM platform such as Splunk or LogRhythm. Proficiency in building Kibana dashboards, visualizations, and complex queries using Elastic search languages (e.g., KQL, ES|QL, Lucene), or comparable experience creating dashboards, visualizations, and complex searches in other SIEM tools (e.g., Splunk SPL, LogRhythm search languages).