Principal Software Engineer - Security - Elasticsearch

The role

You will lead the architecture and design of Elasticsearch's main security features including authentication, authorization, and tenant isolation. You will work with engineering and product leaders to provide high-performance security for a distributed data store at scale.

What you will do

• Own core security initiatives from architecture to production.
• Lead technical design, plan, and execution for major security components inside the Elasticsearch core engine.
• Develop foundational security models for intricate features.
• Optimize security performance at scale in distributed systems environments.
• Apply cryptographic solutions to address customer use cases.
• Ensure robust data isolation within shared infrastructure.
• Monitor and apply latest advancements in security like identity management and cryptography.
• Collaborate with peers to embed security into new customer features.
• Drive vulnerability management efforts with the InfoSec team.
• Leverage AI-driven tools to automate vulnerability triage and investigation.

Required qualifications

• Deep knowledge of Java internals and JVM memory management.
• Understanding of concurrency models.
• Ability to write high-performance, thread-safe, and lock-free code.
• Experience working with large open-source and enterprise codebases.
• Proven experience in designing and building scalable authorization systems.
• Deep experience designing scalable RBAC/ABAC models and token validation pipelines.
• Experience with permission compilation and distributed cache invalidation strategies.
• Solid comprehension of distributed systems security including node-to-node mutual trust and zero-trust transport.
• Deep knowledge of edge identity protocols (OAuth 2.0, SAML).
• Proven track record of using AI to accelerate development, debug systems, and optimize code.
• Ability to collaborate across functions and teams.
• Ability to work autonomously and lead a distributed team using asynchronous communication.

Nice to have

• Knowledge of cipher suites, TLS handshakes, and PKI/certificate lifecycle management.
• Cryptographic methods considering memory usage and delays.
• Familiarity with the implications of Post-Quantum Cryptography (PQC).
• Hands-on experience mapping engine-level technical controls to FedRAMP (Moderate/High), FIPS 140, and SOC 2 requirements.
• Experience working on the internals of a data store or search engine.

Benefits

• Base salary
• Stock program eligibility
• Company-matched 401k up to 6% of eligible earnings
• Health coverage for you and your family in many locations
• Flexible locations and schedules
• Generous number of vacation days each year
• Match up to $2000 for financial donations and service
• Up to 40 hours each year to use toward volunteer projects
• Minimum of 16 weeks of parental leave

Before you apply

• An export license may be required if you are located in or are a national of Belarus, Cuba, Iran, North Korea, Russia, Syria, the Crimea Region of Ukraine, the Donetsk People’s Republic (DNR), or the

About the company

Elastic is the Search AI Company that enables everyone to find answers in real time using all their data at scale. The Elastic Search AI Platform is used by more than 50% of the Fortune 500.