Senior SIEM Data Engineer
State Street2 hours ago
Responsibilities
- Design, build, and maintain scalable SIEM and security telemetry pipelines across hybrid and multi-cloud environments.
- Lead onboarding of telemetry from applications, infrastructure, endpoints, identity platforms, network devices, cloud services, SaaS tools, databases, and security products.
- Define source requirements, expected fields, metadata, routing, retention, and downstream SIEM or analytics use cases.
- Build and optimize parsing, filtering, masking, enrichment, normalization, event-breaking, tagging, and multi-destination routing pipelines.
- Deliver and validate telemetry in Splunk, Databricks, and other SIEM or cyber analytics platforms.
- Support Databricks data engineering patterns across raw, enriched, curated, and analytics-ready layers.
- Establish onboarding standards covering source classification, index routing, taxonomy, metadata, schemas, CIM/ECS alignment, and data quality controls.
- Troubleshoot complex ingestion and data-flow issues across sources, collectors, pipelines, SIEM platforms, Databricks tables, APIs, cloud storage, and streaming platforms.
- Automate deployment, monitoring, alerting, validation, pipeline testing, repeatable onboarding, and operational support.
- Provide second-line support, escalation, root-cause analysis, incident support, and operational handoffs.
- Create data-flow diagrams, field mappings, transformation logic, runbooks, troubleshooting procedures, and engineering documentation.
- Mentor engineers, conduct design reviews, lead technical initiatives, and promote security telemetry and data engineering best practices.
Requirements
- Bachelor’s or master’s degree in computer science, cybersecurity, information technology, engineering, data engineering, data analytics, information systems, or a related technical field; equivalent work experience may be considered.
- 8+ years of experience in SIEM engineering, cybersecurity data engineering, security platform engineering, log analytics, telemetry operations, or large-scale log onboarding.
- Strong hands-on experience with Splunk or a similar SIEM or log analytics platform.
- 3+ years of experience with Cribl Stream or similar data pipeline technologies such as Fluent Bit, Fluentd, Vector, Kafka, Syslog, HEC, REST APIs, cloud-native ingestion services, or streaming platforms.
- 2+ years of experience with Databricks, data lakehouse platforms, large-scale analytics platforms, or security data repositories.
- Experience querying, validating, and transforming data using SPL, SQL, Spark SQL, Python, PySpark, Shell, PowerShell, or similar languages.
- Experience with cloud-native security telemetry and ingestion patterns across hybrid or multi-cloud environments.
- Experience with production support, issue troubleshooting, incident and change management, ticket documentation, root-cause analysis, operational handoffs, vendor coordination, and continuous service improvement.
- Experience mentoring engineers, leading technical initiatives, conducting design reviews, defining onboarding standards, and driving engineering best practices.
- Strong understanding of telemetry data quality, schema design, metadata management, transformation, enrichment, deduplication, batch and streaming ingestion, pipeline monitoring, SIEM taxonomy, and CIM/ECS alignment.
- Relevant Cribl, Splunk, cloud, infrastructure, data engineering, or cybersecurity certifications are preferred.
Benefits
- Potential hybrid work model with in-office presence based on team, business, and location requirements.
- Standard working hours are 8:00 AM to 5:00 PM local time, with occasional flexibility for operational support, incident resolution, escalations, and recovery activities.
- Comprehensive benefits may include retirement savings with company match, medical, dental, vision, life and disability insurance, paid time off, family care support, an Employee Assistance Program, incentive compensation, and tax-advantaged savings plans.
- Flexible work programs, professional development and educational support, paid volunteer days, matching gift programs, and employee networks are available.
Tech Stack
Categories
Data Engineering
About State Street
At State Street, we deliver leading investment platforms, data, expertise, and solutions that accelerate performance and better decision making. With over 200 years of global financial leadership, we equip institutional investors through a comprehensive suite of capabilities: Investment Services: Integrated front-to-back solutions across custody, accounting, and operations. Investment Management: Index and active strategies from one of the world’s largest asset managers. Markets: Multi-asset trading, FX solutions, and data-driven research to enhance portfolio value. Who We Are • 50,000+ employees worldwide • Active in 100+ markets • #1 in ETF servicing What You’ll Find Here • Executive perspectives and thought leadership • Timely market commentary and macro insights • Our views on investment operations, ETFs, private markets, and digital finance • Stories reflecting our culture, values and commitment to diversity and inclusion