Data Security Engineer (Tuning)

Own and optimize end-to-end security telemetry pipelines and tuned detection logic across enterprise and cloud environments.

Responsibilities

• Own end-to-end security telemetry pipelines that support network traffic monitoring, threat hunting, custom detection engineering, and adversary detection
• Work backward from detection objectives to define data sources, collection methods, telemetry fields, retention, and data-quality controls to improve detection coverage
• Architect, build, and maintain telemetry pipelines for network, endpoint, identity, cloud, application, OT, and security-infrastructure data and deploy it into centralized and distributed detection solutions
• Ingest and operationalize telemetry sources including NetFlow, packet capture (PCAP), VPC flow logs, firewall and proxy logs, and DNS records
• Define telemetry needs for network monitoring, threat hunting, incident response, and custom detection engineering by mapping detection goals to underlying data sources
• Assess visibility gaps across on-premises, cloud, remote, and segmented environments
• Normalize, enrich, parse, validate, and maintain telemetry using OCSF or CIM standards so data is queryable and available for correlation
• Troubleshoot ingestion and detection pipeline issues including parsing, latency, retention, field coverage, and data-quality across SIEM, data lake, analytics, and detection platforms
• Design, write, deploy, and tune high-fidelity detection logic using SQL, Sigma, YARA-L, or Python for network-based techniques such as command-and-control beaconing, data exfiltration, and lateral movement
• Reduce false positives while maintaining detection signal and support custom detection development through data discovery, enrichment, normalization, validation, and behavioral/tradecraft-based detection
• Partner with network engineering and stakeholders to evaluate sensors and telemetry sources including NetFlow/IPFIX, DNS and proxy telemetry, firewall logs, IDS/IPS, PCAP, Zeek, network metadata, and NDR platforms
• Create telemetry health metrics, dashboards, and automated checks for missing, delayed, or malformed data and optimize for performance, scalability, reliability, and cost

Requirements

• Associate degree and 6+ years in data engineering, data integration, security engineering, or security operations; or bachelor's degree and 3+ years in the same areas
• Active TS/SCI or SCI eligibility is required
• 3+ years conducting data investigations and using scripting languages for data engineering workflows
• + years of experience using SQL and Python to transform, validate, or analyze data
• Experience using MITRE ATT&CK for security log design
• Experience configuring or tuning data ingestion, parsing, normalization, or enrichment for security data
• Experience using a SIEM, log management platform, or security data lake
• Ability to travel 10%, on average
• Must be legally authorized to work in the United States without employer sponsorship, now or in the future

Technologies

• Structured Query Language (SQL)
• Python
• Sigma
• YARA-L
• OCSF (Open Cybersecurity Schema Framework)
• CIM (Common Information Model)
• MITRE ATT&CK
• NetFlow
• PCAP (packet capture)
• VPC flow logs
• DNS
• IPFIX (Internet Protocol Flow Information Export)
• IDS/IPS (intrusion detection and prevention systems)
• Zeek
• NDR (network detection and response)
• SIEM (security information and event management)
• CI/CD
• AWS, Microsoft Azure, GCP

Team

• Deloitte’s Government & Public Services (GPS) practice serves federal, state, & local government clients and public higher education institutions
• Enterprise Security embeds security in digital transformation by securing a client’s technical backbone while enabling secure digital transformation
• Includes security architecture, secure development and deployment, end-to-end cyber cloud capabilities, application security, and security for emerging technologies and connected products
• Project Delivery Talent Model ties employment to a role on a project

Preferred

• Cyber threat hunting
• Experience with cloud data or security services in AWS, Azure, or GCP
• Experience with version-control and CI/CD tooling to deploy engineering changes

Logistics and Compensation

• Location: Colorado Springs, CO (onsite)
• Salary (Colorado estimate): $95,600 to $159,300 per year
• Recruiting end date: 11/30/2026