1 day ago
Remote, United StatesStaff+
Base Salary
$127k - $189k/yr
Responsibilities
- Administer and improve enterprise SIEM, EDR, SOAR, and security telemetry platforms for reliability, performance, scalability, and cost efficiency.
- Design, build, and maintain high-throughput log routing and data pipelines for enrichment, filtering, transformation, normalization, archiving, and SIEM delivery.
- Engineer SIEM searches, correlation rules, alerts, dashboards, data models, CIM mappings, and risk-based alerting content.
- Define and maintain RBAC, least-privilege models, user provisioning, API integrations, secrets management, and SSO/SAML/OIDC access across SOC platforms.
- Integrate SOC tooling with cloud-native logging, threat intelligence feeds, ticketing and ITSM systems, and enterprise automation workflows.
- Create system designs, reference implementations, runbooks, technical decision records, and operational documentation.
- Troubleshoot complex telemetry and detection issues, reduce noise, close visibility gaps, and support high-severity incident response through targeted searches and log analysis.
- Implement data-quality checks, parsing and field-extraction tests, content regression tests, health monitoring, capacity and latency metrics, and backlog and error observability.
- Evaluate telemetry sources, detection approaches, and vendor capabilities through proofs of concept.
- Contribute to responsible logging and monitoring for AI-enabled applications, including model and service telemetry and prompt or audit logs.
- Represent security telemetry and detection engineering in technical forums and translate post-incident findings into platform and content improvements.
Requirements
- Bachelor's degree in arts/sciences (BA/BS) or equivalent experience is required.
- 6+ years of progressive experience in security engineering, infrastructure engineering, or SOC engineering focused on SIEM/EDR, telemetry pipelines, and detection content.
- Demonstrated experience deploying and operating SIEM, EDR, SOAR, and data-pipeline solutions at enterprise scale, including RBAC, API integrations, and platform hygiene.
- Hands-on experience engineering ingestion pipelines and normalizing logs from operating systems, AWS, Azure, and network sources.
- Strong knowledge of detection engineering, OCSF modeling, SPL optimization, CIM mapping, and content tuning to reduce ingest volume and improve signal-to-noise ratio.
- Ability to collaborate across security operations, architecture, infrastructure, and product teams and document complex systems, data lineage, and schema or field mappings.
- Familiarity with NIST frameworks, MITRE ATT&CK, secure-by-design practices, control validation, and continuous-improvement metrics and KPIs.
- Experience supporting 24/7 SOC operations, on-call participation, and multi-region ingestion scenarios.
- Advanced analytical and problem-solving skills, with competency using Lucidcharts, Visio, and Excel.
- Preferred experience integrating security telemetry into CI/CD pipelines using version control, testing, and staged releases.
- Preferred proficiency in Python or PowerShell, SOAR tools such as Tines, and infrastructure as code such as Terraform.
- Preferred master's degree or professional industry certification.
- Preferred relevant platform certifications such as Splunk Core/Cloud, Cribl Certified Observability Engineer, or CrowdStrike CCFA/CCFR.
- Preferred security certifications such as CISSP, GSEC, GCDA, or Cloud+.
Benefits
- Hybrid work arrangement is indicated by the #LI-HYBRID posting designation.
- RGA provides health, retirement, and other employee benefits.
- The role includes an annual bonus plan, and some positions are eligible for a long-term equity incentive plan.
- Employees can work with diverse colleagues globally in a respectful environment with career-development opportunities.
Tech Stack
Categories
Data EngineeringSecurity
About R/GA
R/GA is a creative and technology agency that designs brand systems, digital products, and marketing programs for global enterprises. It operates on project and retainer-based agency services across strategy, design, engineering, and communications. Founded in 1977 and headquartered in New York, the company is privately held under Truelink Capital and maintains a global studio network serving consumer, retail, finance, and technology clients.