1 month ago
Base Salary
$156k - $234k/yr
Responsibilities
- Design, build, and operate resilient batch and streaming pipelines ingesting high volumes of cybersecurity telemetry.
- Normalize and enrich heterogeneous SOC data into standardized schemas for analytics and detection platforms.
- Architect and maintain enterprise-scale data lakes, warehouses, and streaming storage backbones.
- Tune pipeline throughput, storage partitioning, query performance, cost, and reliability as telemetry volumes grow.
- Implement monitoring, alerting, self-healing, data-quality, and availability capabilities for production pipelines.
- Define schemas, taxonomies, metadata standards, architecture documentation, data dictionaries, and operational runbooks.
- Build reusable frameworks and automation for onboarding new telemetry sources.
- Ensure encryption, access control, secure handling, and regulatory compliance throughout the data lifecycle.
- Partner with security operations, detection engineering, threat and exposure management, and data science teams.
Requirements
- Demonstrated expertise architecting and operating large-scale, mission-critical data platforms from the ground up.
- Extensive hands-on experience with large-scale batch and streaming pipelines using technologies such as Cribl, Kafka, Spark, Flink, or Airflow.
- Deep experience with data lake and warehouse architecture, including storage formats, partitioning strategies, and query engines.
- Experience with AWS, Azure, or GCP data infrastructure, including storage tiering, cost optimization, and event-driven architectures.
- Strong understanding of security telemetry such as logs, network flow, endpoint/EDR data, identity events, and cloud audit logs.
- Advanced proficiency in Python, Go, Java, or Scala for pipeline development and automation.
- Deep experience with schema design, data modeling, and metadata management for heterogeneous, high-velocity datasets.
- Grounding in cybersecurity fundamentals, particularly SOC/OSVM operations, log management, and detection and analytics use cases.
- Extensive experience with relational, NoSQL, time-series, and columnar or analytical database technologies.
- Strong software engineering fundamentals including version control, automated testing, infrastructure automation, and observability practices.
- Demonstrated ability to architect for scale and reliability in mission-critical 24x7 environments.
- 10+ years of experience architecting data platforms specifically for SOC, SIEM, or XDR environments is preferred.
- Familiarity with AI/ML pipeline requirements, open table formats, and modern lakehouse architectures is preferred.
- Relevant cloud data engineering or GIAC certifications are a plus but are not required in lieu of hands-on expertise.
- Bachelor's or university degree, or equivalent experience, is required; a master's degree is preferred.
Benefits
- Full-time position based in Irving, Texas.
- Salary range of $156,160.00 to $234,240.00.
- Medical, dental, and vision coverage; 401(k); life, accident, and disability insurance; and wellness programs.
- Paid vacation, sick leave, and holidays.
- Additional discretionary and formulaic incentive and retention awards may be available to eligible employees.
Tech Stack
Amazon RedshiftApache AirflowApache FlinkApache KafkaApache SparkAWSAzureGoGoogle BigQueryGoogle Cloud PlatformJavaPythonScalaSnowflake
Categories
Data Engineering
About Citi
Citi is a public financial-services company offering consumer and institutional banking, credit cards, wealth management, treasury and trade solutions, and capital-markets services. It serves individuals, corporations, financial institutions, and governments in more than 160 countries and jurisdictions, earning interest and fee income from lending, payments, trading, and advisory. Founded in 1812 and headquartered in New York, it trades on the NYSE under the ticker C.