Security Engineer, Clio

• Are you someone who is always probing and asking why, someone who enjoys finding smarter and more efficient solutions to problems? If so, we have a spot for you on Clio's security team. If you have a strong operations background with a passion for security and experience in cloud-first environments, then we want to talk to you
• Hands-on experience running OpenSearch or Elasticsearch clusters, including scaling, tuning, upgrades and troubleshooting
• Experience building log ingestion and parsing pipelines with tools like Logstash, Fluent Bit, Opensearch Ingestion
• Familiarity with streaming services such as Kinesis, Kafka
• 3+ years working in AWS environments, with a solid understanding of how to secure them
• Working knowledge of infrastructure as code tools like Terraform or Puppet
• Ability to write Python or Ruby to automate operational work
• Strong Linux skills
• Curiosity about how security teams use log data, and a keen interest in improving your craft by using AI
• Experience with Kubernetes and/or EKS

Desirable

• We are currently seeking an Infrastructure Security Engineer to join our rapidly growing Security team. This role is for someone passionate about building proactive security solutions, implementing detection capabilities, and driving security automation at scale. You will be exposed to new challenges and technologies while making a tangible impact
• This role sits on our logging team. At most companies logging lives in infrastructure or platform engineering. At Clio it sits inside Security, and we own it end to end. Reliable, tamper-resistant logs are the foundation of our entire security posture. Without trustworthy evidence, nothing else in a security program holds up
• We ensure timely ingestion, proper transformation, and high availability of logging data to all our internal customers. Our goal is to support our existing logging infrastructure, while also working to build out the next generation architecture needed to support growing security programs
• Onboard new log sources end to end: collect the data, parse and normalize it, and land it in OpenSearch
• Scale and tune our OpenSearch clusters in AWS, including node sizing, shard and index strategy, and storage tiers
• Handle cluster maintenance: version upgrades, snapshots and restores, and index lifecycle policies
• Troubleshoot ingestion delays, parsing failures and cluster health issues and take part in triaging issues as they come in
• Automating existing manual work and moving infrastructure into code
• Model log data so fields are consistent and queryable across sources
• Maintain the access controls that keep log data complete, trustworthy and tamper-resistant
• Contribute to the design of our next-generation logging platform and the SIEM that will run on it, working closely across teams to achieve this