SisaInfosec- Product Support Engineer

Role Overview

Responsible for providing onsite technical ownership of the deployed platform, ensuring platform availability, system stability, ProACT / Elastic Stack administration, Linux platform support, integration troubleshooting and customer-facing technical support. Acts as the primary interface between the customer, Product Engineering and internal support teams.

Core Responsibilities

• Administer and support Linux-based production servers hosting the product platform.
• Monitor and troubleshoot ProACT, Elasticsearch, Logstash components.
• Monitor end-to-end log ingestion pipelines and resolve ingestion failures, mapping conflicts, parsing issues, Kafka lag and Redis backlog.
• Manage Elasticsearch indices, shards, replicas, ILM policies, snapshots and cluster health.
• Perform production incident triage, root cause analysis (RCA) and preventive actions.
• Coordinate with Product Engineering for defect analysis, bug fixes and product improvements.
• Execute product upgrades, patches, change requests and validate post-change health.
• Develop Shell/Bash and Python scripts for operational automation, health checks and routine maintenance.
• Conduct platform health checks, capacity reviews and preventive maintenance.
• Serve as the onsite technical point of contact and provide regular technical updates to customer stakeholders.
• Prepare SOPs, knowledge articles and deployment documentation.

Required Technical Skills

• Strong Linux administration (RHEL/CentOS/Rocky Linux preferred).
• Basic to advanced Shell/Bash and Python scripting.
• Hands-on experience with Elasticsearch, Kibana and Logstash.
• Knowledge of Elasticsearch architecture (nodes, shards, replicas, mappings, templates, ILM, snapshots.
• Experience troubleshooting indexing, search performance, ingestion pipelines and cluster health.
• Knowledge of Kafka, Redis and log processing pipelines.
• Understanding of REST APIs, JSON, Git and automation fundamentals.
• Strong understanding of TCP/IP, DNS, SSL/TLS, ports and network troubleshooting.
• Knowledge of SIEM concepts, log correlation and security event lifecycle.
• Experience with Elasticsearch performance tuning, JVM/heap analysis, shard optimization and rolling upgrades.

Integration Knowledge (Good to have)

• Syslog / RSyslog / Syslog-NG.
• REST API and Webhook integrations.
• Agent-based and agentless log collection.
• Windows Event Collection and Linux Syslog.
• TLS certificate troubleshooting.
• LDAP / Active Directory authentication basics.
• SFTP/file-based integrations.
• Basic SQL knowledge for integration troubleshooting.

Infrastructure Knowledge (Good to have)

• Physical server environments.
• VMware or Hyper-V virtualization.
• Storage concepts (SAN/NAS, RAID, LVM).
• LLM Implementation (exposure)
• Backup & Restore validation.
• Server performance and capacity monitoring.

Preferred / Optional Skills

• Prometheus/Grafana monitoring.
• Docker/Kubernetes exposure.
• Cloud platform awareness (AWS/Azure/GCP).
• High Availability (HA) and Disaster Recovery (DR) concepts.
• Ansible or similar automation tools.

Customer & Behavioural Skills

• Strong customer communication and stakeholder management.
• Ability to independently troubleshoot within customer environments.
• Lead technical discussions during production incidents.
• Coordinate with Infrastructure, Security, SOC and Product Engineering teams.
• Produce clear technical documentation and RCA reports.

Preferred Certifications

• RHCSA/RHCE
• Elastic Certified Engineer (optional)
• ITIL Foundation
• CompTIA Security+

KPIs

• SLA Compliance
• Platform Availability
• MTTR Reduction
• First Response SLA
• RCA Completion within SLA
• Repeat Incident Reduction
• Change Success Rate
• Customer Satisfaction (CSAT)
• Knowledge Base Contributions
• Operational Automation Contributions

Additional Senior Role Expectations

• Lead P1/P2 incidents and major problem investigations.
• Mentor junior engineers.
• Drive platform optimization and continuous improvement initiatives.
• Review architecture and recommend operational enhancements.