If you've installed the product, set up correlation searches and asset and identity correlation, plus tuned the searches and confirmed that Vulnerability Center is working, I'd say that the next steps are for the SOC analysts and security teams to actually use the product, and then get engineering-on-demand tasks from those teams.
Are there integrations with tools that those teams use that aren't set up? Are there additional data sources that they might want later? Or some adaptive response or workflow actions that they might want set up so that they can more easily respond to and remediate issues? Those are some tasks that might come up later, but you'll have to work with the security teams to understand their use cases and what they cannot do with ES now that it's set up that might require extending it. You can find documentation about how to write new adaptive response actions on dev.splunk.com: http://dev.splunk.com/view/enterprise-security/SP-CAAAFBF
