Senior SIEM Data Engineer
State Street9 days ago
Base Salary
$120k - $203k/yr
Responsibilities
- Design, build, and maintain scalable SIEM and security telemetry pipelines across hybrid and multi-cloud environments.
- Lead onboarding of telemetry from applications, infrastructure, endpoints, identity platforms, network devices, cloud services, SaaS tools, databases, and security products.
- Define source log requirements, expected fields, metadata, routing, retention, and downstream SIEM or analytics use cases.
- Build and optimize pipelines for parsing, filtering, masking, enrichment, normalization, event breaking, metadata tagging, and multi-destination routing.
- Deliver reliable telemetry to Splunk, Databricks, and other SIEM or cyber analytics platforms.
- Design and support Databricks data engineering patterns across raw, enriched, curated, and analytics-ready layers.
- Validate data freshness, completeness, correctness, availability, timestamp accuracy, schema consistency, source attribution, routing accuracy, and latency.
- Establish SIEM onboarding standards for source classification, source types, index routing, taxonomy alignment, metadata tagging, schema expectations, CIM/ECS alignment, and data quality controls.
- Optimize telemetry pipelines to reduce noise and ingestion cost while improving performance and preserving high-value security data.
- Troubleshoot complex ingestion and data-flow issues across sources, collectors, pipelines, SIEM platforms, Databricks tables, APIs, cloud storage, and streaming platforms.
- Provide second-line support, escalation, root-cause analysis, and operational support for data engineering jobs, ingestion failures, and data delivery issues.
- Automate deployment, monitoring, alerting, validation, pipeline testing, repeatable onboarding, and operational support.
- Partner with Detection Engineering, Security Operations, Cyber Data Science, Observability, Cloud, Infrastructure, Application, Governance, Risk, and Platform teams.
- Maintain onboarding standards, data-flow diagrams, field mappings, transformation logic, runbooks, troubleshooting procedures, operational handoffs, and engineering documentation.
- Mentor engineers, conduct design reviews, lead technical initiatives, and promote best practices for security telemetry onboarding, data quality, automation, reliability, and operational excellence.
Requirements
- Bachelor’s or master’s degree in computer science, cybersecurity, information technology, engineering, data engineering, data analytics, information systems, or a related technical field, or equivalent work experience.
- 8+ years of experience in SIEM engineering, cybersecurity data engineering, security platform engineering, log analytics, telemetry operations, or large-scale log onboarding.
- Strong hands-on experience with Splunk or similar SIEM/log analytics platforms.
- 3+ years of experience with Cribl Stream or similar data pipeline technologies.
- 2+ years of experience with Databricks, data lakehouse platforms, large-scale analytics platforms, or security data repositories.
- Experience querying, validating, and transforming data using SPL, SQL, Spark SQL, Python, PySpark, Shell, PowerShell, or similar languages.
- Experience with cloud-native security telemetry and ingestion patterns across hybrid or multi-cloud environments.
- Experience with production support, troubleshooting, incident management, change management, ticket documentation, root-cause analysis, operational handoffs, vendor coordination, and continuous service improvement.
- Experience mentoring engineers, leading technical initiatives, conducting design reviews, defining onboarding standards, and driving engineering best practices.
- Strong understanding of data quality, schema design, metadata management, transformation, enrichment, deduplication, batch and streaming ingestion, pipeline monitoring, SIEM taxonomy, source classification, security use-case mapping, and CIM/ECS alignment.
- Strong troubleshooting, documentation, communication, stakeholder management, prioritization, mentoring, and end-to-end ownership skills.
- Relevant Cribl, Splunk, cloud, infrastructure, data engineering, or cybersecurity certifications are preferred.
Benefits
- Hybrid work model with in-office presence based on team, business, and location expectations.
- Standard working hours are 8:00 AM to 5:00 PM local time, with occasional flexibility for operational support, releases, incidents, escalations, and recovery activities.
- Competitive benefits including medical, dental, vision, life, disability, insurance, retirement savings with company match, paid time off, family care support, an Employee Assistance Program, incentive compensation eligibility, and tax-advantaged savings plans.
- Flexible Work Program, development programs, educational support, paid volunteer days, matching gift program, and employee networks.
Tech Stack
Categories
Data Engineering
About State Street
State Street is a global custodian bank and asset manager serving institutional investors with investment servicing, fund accounting, trading/FX, data, and index/active strategies. Its products include State Street Global Advisors’ funds and ETFs, the Charles River Investment Management Solution, and the front-to-back State Street Alpha platform. Founded in 1792 and headquartered in Boston, the company is publicly traded on the NYSE (ticker: STT) and operates across major markets worldwide.