Senior Security Engineer, Data Pipeline & Observability (Remote - US only)

The team supports clients from a Mid-Atlantic practice, but the role itself is remote within the US. Some travel may be required (up to 15%). A privately held, fast-growing information security services firm is hiring a senior engineer for its data integration practice. You will design and run security telemetry pipelines that cut SIEM ingest costs, keep data consistent, and move clients between platforms without losing quality. You will also explain cost and risk trade-offs to technical teams and executives. The role works alongside detection, automation, and vendor partner engineering teams.

What you'll do

• Design, deploy, and tune telemetry pipelines using Cribl Stream, Edge, Lake, and Search, or comparable tools such as OpenTelemetry Collector, Splunk Edge Processor, or Datadog Observability Pipelines
• Onboard and normalize logs from syslog, agents, cloud providers, SaaS APIs, identity platforms, EDR, and network devices into common schemas such as OCSF, Splunk CIM, Elastic ECS, or Google UDM
• Build filtering, enrichment, and tiering strategies that send high-value data to premium analytics platforms and keep full-fidelity copies in low-cost storage with replay
• Model baseline ingest and savings, then present before-and-after results to technical and financial stakeholders
• Lead the data workstream for SIEM and platform migrations, and deliver pipeline health checks with prioritized roadmaps
• Serve as technical point of contact on client engagements, producing as-built documentation, runbooks, and knowledge transfer

What you need

• 5+ years in cybersecurity, IT operations, or data engineering, including 3+ years running production telemetry pipelines
• Hands-on production experience with Cribl Stream or a comparable pipeline platform
• Working knowledge of at least one SIEM or analytics destination such as Splunk, Elastic, Microsoft Sentinel, Google SecOps, CrowdStrike, or SentinelOne
• Linux administration and networking fundamentals (syslog over TCP/UDP/TLS, load balancing, firewalls) and experience with logging services in AWS, Azure, or GCP
• Scripting and data skills in Python, JavaScript, or Bash; regular expressions; REST APIs; and JSON, CSV, XML, and key-value formats
• Ability to brief senior leadership in writing and in person, tying technical work to measurable business goals
• Must be based in the United States. Cribl Certified User and Certified Admin (Stream) required at hire or within 90 days

Applicants must be based in: United States.

How to apply

Get the free i'llTip app to see the employer's details and apply. i'llTip's AI can tailor your résumé to this job, and you'll get alerts for similar roles.

Prefer the website? Continue on illtip.comOr get the app: Android · iPhone

🔔 Get new jobs like this first: join i'llTip Jobs on Telegram · or get personal job alerts