Senior Software Engineer - Security - Elasticsearch

About the Role

Elastic is seeking a Senior Software Engineer to join the Elasticsearch Security team. You will contribute to the architecture and design of core Elasticsearch features, including authentication, authorization, and tenant isolation. You will work closely with engineering and product leadership to deliver high-performance security at scale within our distributed data store.

What You Will Be Doing

• Core Development: Lead technical design, planning, and execution for major security components within the Elasticsearch core engine.
• Security Architecture: Develop foundational security models and optimize performance in distributed systems environments.
• Cryptography: Apply cryptographic solutions to address complex customer use cases.
• Data Isolation: Ensure robust data isolation within shared infrastructure supporting disparate customers.
• Vulnerability Management: Collaborate with the InfoSec team to proactively identify, assess, and remediate risks, leveraging AI-driven tools for automated triage.
• Collaboration: Partner with cross-functional teams to embed security into new features from the outset.

What You Bring

• Java Expertise: Deep knowledge of Java internals, JVM memory management, and high-performance, thread-safe, lock-free programming.
• Authorization Systems: Experience building scalable, performant authorization systems, including access models and token validation at scale.
• Distributed Systems: Solid comprehension of node-to-node mutual trust, zero-trust transport, and cluster state propagation.
• Identity Protocols: Deep knowledge of edge identity protocols (OAuth 2.0, SAML).
• AI Integration: Proven track record of using AI to accelerate development and debug complex systems.
• Autonomy: Ability to work effectively in a distributed team using asynchronous and transparent communication.

Bonus Points

• Knowledge of TLS handshakes, PKI, and certificate lifecycle management.
• Familiarity with Post-Quantum Cryptography (PQC) implications.
• Experience mapping technical controls to FedRAMP, FIPS 140, or SOC 2 requirements.
• Experience working on the internals of a data store or search engine.