• Own advanced troubleshooting for Microsoft 365 and Intune issues. • Work closely with onshore leads/architects, security, identity, messaging/collaboration, and networking teams. • Deliver scoped engineering tasks aligned to project plans. • Configure and support Microsoft Intune and core M365 services. • Implement and maintain endpoint security configurations.

• Architect and own the Elastic Stack (Elasticsearch, Logstash, Beats/Elastic Agent, Kibana) supporting high-volume security telemetry ingestion, detection, and search. • Direct implementation experience with ECK is required. • Design data models, index lifecycle management (ILM) strategies, sharding, and hot-warm-cold tiering for petabyte-scale, multi-tenant security data. • Build and harden ingestion pipelines from EDR, network, cloud, and log sources into the Elastic Stack, in partnership with detection engineering. • Tune cluster performance — query latency, indexing throughput, resource allocation — and drive capacity planning for growth. • Own Elastic Stack security, upgrades, and reliability, including runbooks, monitoring, and incident response for the platform itself. • Evaluate and roll out new Elastic capabilities (e.g., Elastic Security, ES|QL, machine learning jobs) that improve detection speed and analyst experience. • Set technical direction for and mentor a small team of Elastic engineers, establishing standards, review practices, and on-call structure for the platform. • Document architecture decisions, standards, and best practices, and represent the Elastic platform in cross-functional planning and vendor (Elastic) conversations.

• Own features end-to-end across the complete software development lifecycle including AI, spanning requirements gathering, technical design, implementation, testing, automation, deployment, and ongoing operational ownership in production • Translate customer and business needs into clear technical solutions, making thoughtful trade-offs that balance speed, quality, and reliability • Design, build, and maintain highly scalable, distributed systems that handle large volumes of data • Identify and resolve pre-production bottlenecks and production issues, improving system resilience and performance • Participate in design and code reviews, contributing to shared engineering standards and long-term system health • Partner closely with product managers, SREs, and multi-functional teams to deliver meaningful customer outcomes • Participate in a rotating on-call schedule, diagnosing and resolving production issues to ensure reliability and customer trust

• Own and lead incident response readiness across KOHO. • Plan and execute adversarial simulations: scope engagements, operate within defined rules of engagement, conduct offensive operations, and deliver findings that drive measurable security improvements. • Expand incident response readiness across KOHO and build response playbooks for marketing, data, legal, people & culture, risk, etc. • Conduct table top exercises with c-level to test risk acceptance and limitations. • Document lessons learned, operational improvements, and playbook updates. Execute all improvements. • Lead incident response/DFIR during a cybersecurity incident. • Conduct post incident documentation to determine contributing factors and lessons learned. • Design and deploy internal deception assets to detect lateral movement, insider threats, and unauthorized access across KOHO's environment. • Build external-facing deception capabilities, including fake credentials, canary tokens embedded in customer-facing surfaces, and decoy infrastructure seeded in breach databases and other attacker-accessible surfaces. • Instrument deception assets to generate actionable threat intelligence and feed findings back into detection logic, playbooks, and the broader threat model. • Build the triage and response workflow for deception-triggered alerts into existing SOC operations, from signal to investigation to lessons learned.