BI and Analytics Lead

Everforth ECS is seeking a Lead BI & Visualization Engineer with a strong foundation in cybersecurity and vulnerability data to guide the technical direction and delivery of our enterprise analytics and dashboard products. In this role, you will lead a dedicated cross-functional team—collaborating closely with BI developers, QA testers, DevOps, and Site Reliability Engineers (SREs)—responsible for the end-to-end lifecycle of our operational intelligence platform.

Rather than building custom web applications from scratch, your core technical domain centers on the Elasticsearch and Kibana ecosystem. You will own the “last mile” of our analytical pipeline: architecting Elasticsearch ingest pipelines, designing real-time continuous data transforms, standardizing index mappings, and authoring high-performance Kibana visualizations and Canvas reports.

Crucially, you understand what lives inside the data: you know vulnerability management, threat metrics, CVEs, and CVSS severity scoring. Because you will be working with data that has already been normalized, deduplicated, and correlated from multiple security tools into a standardized data set, you will focus on building intuitive, high-level visualizations that help cybersecurity teams immediately pinpoint and remediate critical enterprise risks.

Because we treat our dashboard suite as an enterprise software product, you will apply rigorous software delivery practices to low-code and configuration-driven BI deliverables: managing JSON visualization definitions in Git/GitHub, driving automated validation and deployment pipelines, and ensuring zero-downtime releases across Dev, Test, and Production environments.

To ensure clear ownership across our engineering organization:

• Data Management Team: Owns upstream data governance, target definitions, and source system access.
• Pipeline Dev Team: Owns upstream transport, raw extraction, and Python-based streaming/ingestion into storage topics or raw indices. This team is responsible for normalizing, deduplicating, and correlating data sets from individual tools (such as Tenable, Qualys, CrowdStrike, and Rapid7) through various CAASM platforms to deliver a clean, standardized security data model.
• Your Team (BI & Analytics Engineering): Owns everything inside the Elasticsearch analytical layer down to the user screen—ingesting the standardized cyber data sets, managing Elasticsearch Ingest Pipelines, Painless script processors, Continuous Transforms, Kibana Lens/Canvas dashboards, saved object configuration management, and release automation.

• Standardized Security Data Focus: Leverage pre-normalized, deduplicated, and correlated vulnerability and security telemetry data sets to construct unified executive and operational views.
• Risk Prioritization Dashboards: Design intuitive workflows that enable analysts to zero in on critical-severity vulnerabilities, exploitation status (e.g., CISA KEV catalog alignment), SLA breach risks, and patch remediation velocity across the entire enterprise.
• Stakeholder Translation: Act as the primary liaison between cyber operations/leadership and technical implementation, turning operational questions into structured metrics and clear visual narratives.

• Ingest Pipelines & Transforms: Design, build, and maintain Elasticsearch Ingest Pipelines (using grok, dissect, date, user-agent, and Painless script processors) to enrich and prepare incoming data models before indexing.
• Continuous Aggregations & Performance: Create Elasticsearch Continuous Transforms to pre-compute rolling metrics (e.g., 30-day active vulnerability states, MTTR by business unit, unique impacted host counts), eliminating search-time overhead and cluster circuit-breaker issues.
• Schema Governance & Optimization: Enforce strict mapping standards (aligned with Elastic Common Schema / ECS) to ensure query speed, index efficiency, and long-term storage sustainability alongside Index Lifecycle Management (ILM) policies.

• Configuration as Code: Treat Kibana dashboards, index patterns, searches, and Canvas workpads as version-controlled software assets, managing JSON saved objects in Git/GitHub repositories.
• Release Automation: Partner with DevOps and SRE to automate artifact packaging, validation testing, and multi-environment promotion (Dev → Test → Prod) with zero downtime.
• Performance & Reliability Monitoring: Collaborate with SREs to monitor query execution times, slow logs, and cluster resource utilization, ensuring enterprise dashboards load within sub-second thresholds.

• Team Leadership: Lead daily agile delivery for a team of 3–5 BI developers and analysts, establishing code review practices for pipeline processors and dashboard JSON definitions.
• Enablement & Standards: Define enterprise UX/UI style guides, color accessibility standards, naming conventions, and visualization guidelines.
• Capability Building: Mentor team members in advanced Elasticsearch DSL, Painless scripting, Kibana Vega/Lens visualization techniques, and cyber domain fundamentals.

Salary Range: $158,000 - $237,000
General Description of Benefits

• 10+ years of experience in an IT related field 
• 5+ years of hands-on experience in BI engineering, analytics engineering, or data visualization, with at least 2+ years acting as a Tech Lead, Team Lead, or Senior Engineer mentoring others.
• Direct experience analyzing security data (vulnerabilities, CVE/CVSS frameworks, asset inventories, patch compliance, or SOC telemetry). Must demonstrate an understanding of how to work with unified, correlated data sets and how security leaders prioritize critical vs. low-impact risks.
• Expert-level mastery of Kibana (Lens, TSVB, Discover, Canvas, Saved Objects, Dashboard drill-downs, and Vega/custom visualization).
• Strong proficiency in Elasticsearch Ingest Node pipelines, Painless scripting, continuous Transforms, index templates, and Query DSL aggregations.
• Fluency in Git/GitHub workflows (branching models, pull requests, automated linting/validation, and peer reviews) applied to configuration files and JSON schemas.
• Practical understanding of CI/CD concepts and multi-tiered release promotion (Dev/Test/Prod).
• Advanced proficiency in SQL and Elasticsearch KQL/DSL.