• Architect and own the Elastic Stack (Elasticsearch, Logstash, Beats/Elastic Agent, Kibana) supporting high-volume security telemetry ingestion, detection, and search. • Direct implementation experience with ECK is required. • Design data models, index lifecycle management (ILM) strategies, sharding, and hot-warm-cold tiering for petabyte-scale, multi-tenant security data. • Build and harden ingestion pipelines from EDR, network, cloud, and log sources into the Elastic Stack, in partnership with detection engineering. • Tune cluster performance — query latency, indexing throughput, resource allocation — and drive capacity planning for growth. • Own Elastic Stack security, upgrades, and reliability, including runbooks, monitoring, and incident response for the platform itself. • Evaluate and roll out new Elastic capabilities (e.g., Elastic Security, ES|QL, machine learning jobs) that improve detection speed and analyst experience. • Set technical direction for and mentor a small team of Elastic engineers, establishing standards, review practices, and on-call structure for the platform. • Document architecture decisions, standards, and best practices, and represent the Elastic platform in cross-functional planning and vendor (Elastic) conversations.

• Own features end-to-end across the complete software development lifecycle including AI, spanning requirements gathering, technical design, implementation, testing, automation, deployment, and ongoing operational ownership in production • Translate customer and business needs into clear technical solutions, making thoughtful trade-offs that balance speed, quality, and reliability • Design, build, and maintain highly scalable, distributed systems that handle large volumes of data • Identify and resolve pre-production bottlenecks and production issues, improving system resilience and performance • Participate in design and code reviews, contributing to shared engineering standards and long-term system health • Partner closely with product managers, SREs, and multi-functional teams to deliver meaningful customer outcomes • Participate in a rotating on-call schedule, diagnosing and resolving production issues to ensure reliability and customer trust

• Own and lead incident response readiness across KOHO. • Plan and execute adversarial simulations: scope engagements, operate within defined rules of engagement, conduct offensive operations, and deliver findings that drive measurable security improvements. • Expand incident response readiness across KOHO and build response playbooks for marketing, data, legal, people & culture, risk, etc. • Conduct table top exercises with c-level to test risk acceptance and limitations. • Document lessons learned, operational improvements, and playbook updates. Execute all improvements. • Lead incident response/DFIR during a cybersecurity incident. • Conduct post incident documentation to determine contributing factors and lessons learned. • Design and deploy internal deception assets to detect lateral movement, insider threats, and unauthorized access across KOHO's environment. • Build external-facing deception capabilities, including fake credentials, canary tokens embedded in customer-facing surfaces, and decoy infrastructure seeded in breach databases and other attacker-accessible surfaces. • Instrument deception assets to generate actionable threat intelligence and feed findings back into detection logic, playbooks, and the broader threat model. • Build the triage and response workflow for deception-triggered alerts into existing SOC operations, from signal to investigation to lessons learned.

• Build Blazor WASM components with clean, reusable patterns and accessibility in mind • Implement Minimal API endpoints in .NET with OpenAPI, validation, and performance in focus • Contribute to our MAUI mobile app, including shared component libraries • Work with EF Core and SQL (Postgres); define/maintain database relationships and manage code-first EF Core migrations • Support real time UI behavior using SignalR where needed • Leverage Claude Enterprise to generate, refactor, and maintain test scripts efficiently, and help define best practices for AI-assisted testing on the team • Integrate authentication/authorization via Microsoft Entra ID (OIDC/OAuth2, MSAL, roles/scopes) • Ship via Azure DevOps (repos, pipelines, environments), following branch policies and PR reviews • Improve code quality through SonarCloud rules aligned with our standards • Generate and consume API clients from OpenAPI/Swagger for typesafe integration • Instrument services with distributed tracing and logging using Azure Application Insights • Help monitor service health, failure rates, and performance; participate in alert triage for staging/production • Work in three-week sprints with Product to refine user stories and acceptance criteria