This role pays more than
64%
of similar roles. Most pay
$144,562–$216,271
— the shaded band above.
At the midpoint, this role pays about
$195k
versus about
$180k
for comparable roles.
Based on 240 similar postings.
Employer
About Citi
Citi is one of the world’s most trusted financial institutions, proudly serving millions of customers across the United States.
Citi currently has
271 open roles
on FindRole.
Listed pay typically runs
$125,760–$188,640
across 255 roles with salary data.
Data Platform Engineer, Cybersecurity Operations joins the team to build and operate scalable data pipelines, storage backbones, and data lakes powering next-generation cybersecurity operations. This role focuses on ingesting and normalizing massive volumes of SOC telemetry, including logs, network flow data, and identity signals into high-performance analytics platforms. The engineer will design robust normalization logic, manage data lake infrastructure for high-volume security telemetry, and ensure low-latency delivery to SIEM/XDR tools. Key technologies include Cribl, Kafka, Spark, Flink, Airflow, and cloud-native infrastructures like AWS, Azure, or GCP. Candidates must be proficient in Python, Go, Java, or Scala while managing data lakes using Delta Lake, Iceberg, Snowflake, BigQuery, or Redshift. The role solves the technical challenge of transforming heterogeneous security data into standardized schemas for consistent downstream consumption across detection and analytics teams.
Design, build, and operate high-throughput batch and streaming data pipelines for security telemetry.
Develop normalization and enrichment logic to transform heterogeneous logs into standardized schemas.
Architect and maintain a scalable storage backbone including data lakes and warehouses for enterprise-scale data.
Optimize pipeline throughput, storage partitioning, and query performance to handle growing data volumes.
Implement monitoring, alerting, and self-healing capabilities to ensure production-scale reliability and data quality.
Define and enforce data schemas, taxonomies, and metadata standards across all ingested telemetry sources.
Build automated frameworks to rapidly onboard new telemetry sources as the ecosystem expands.
Ensure secure handling, encryption, and access control for sensitive security data throughout its lifecycle.
What we're looking for
Bachelor's degree or equivalent experience required; Master's degree preferred.
Proven track record of architecting and operating large-scale, mission-critical data platforms from the ground up.
Extensive experience building and operating batch and streaming data pipelines using tools like Cribl, Kafka, Spark, Flink, or Airflow.
Deep expertise in data lake and warehouse architecture (e.g., Delta Lake, Iceberg, Snowflake, BigQuery, Redshift) at enterprise scale.
Proficiency in cloud-native data infrastructure (AWS/Azure/GCP), including storage tiering and event-driven architectures.
Advanced proficiency in a major programming language such as Python, Go, Java, or Scala.
Strong software engineering fundamentals including CI/CD, infrastructure-as-code, version control, and observability practices.
10+ years of experience in architecting data platforms for SOC, SIEM, or XDR environments (preferred); familiarity with AI/ML pipeline requirements (preferred).