SIEM Data Engineer

What you'll do

• Onboard security telemetry from applications, infrastructure, cloud services, and various security products.
• Analyze source log formats to define ingestion requirements, metadata, and downstream analytics use cases.
• Configure telemetry pipelines for parsing, filtering, masking, enrichment, and normalization.
• Route security telemetry to Splunk, Databricks, and other cyber analytics platforms.
• Validate data quality for freshness, completeness, timestamp accuracy, and schema consistency.
• Troubleshoot ingestion and data flow issues across collectors, pipelines, APIs, and cloud storage.
• Provide second-line-of-defense support for operational issues related to data engineering jobs and pipeline failures.
• Document onboarding patterns, transformation logic, data flow diagrams, and troubleshooting procedures.

What we're looking for

• Bachelor's or Master's degree in a technical field or equivalent work experience.
• 5+ years of experience in SIEM engineering, security data engineering, cybersecurity platform operations, or log analytics.
• 2+ years of experience with Cribl Stream or similar data pipeline technologies like Fluent Bit, Vector, or Kafka.
• 2+ years of experience with Databricks, data lakehouse platforms, or large-scale security data repositories.
• Hands-on experience using Splunk or similar SIEM/log analytics platforms.
• Experience querying and validating data using SPL, SQL, Spark SQL, Python, or Shell.
• Experience onboarding and troubleshooting security telemetry from cloud, endpoint, network, identity, and application sources.
• Relevant certifications such as Cribl Certified Observability Engineer or Splunk certifications (preferred).