Security Data Engineer

Deloitte’s Enterprise Security team is seeking a Security Data Engineer to support clients with the design, implementation, and ongoing improvement of enterprise security solutions. This onsite role in Colorado Springs focuses on network-centric detection engineering, telemetry pipeline development, and reliable delivery of security data to SIEM and detection platforms.

Key Responsibilities

• Design, write, and deploy high-fidelity detection rules using SQL, Sigma, YARA-L, or Python for network-based attack techniques such as C2 beaconing, data exfiltration, and lateral movement.
• Continuously tune network detections to reduce false positives while preserving a strong signal-to-noise ratio.
• Determine the telemetry needed to support network monitoring, threat hunting, incident response, and custom detection engineering.
• Map detection needs to underlying data sources and identify visibility gaps across hybrid cloud and on-premises environments.
• Design and maintain pipelines to ingest security telemetry from network, endpoint, identity, cloud, application, OT, and security infrastructure.
• Ensure telemetry is delivered reliably to SIEM, data lake, analytics, and detection platforms; troubleshoot issues involving ingestion, parsing, latency, and data quality.
• Assess whether packet, flow, session, DNS, proxy, authentication, endpoint, and application telemetry are sufficient for specific detection requirements.
• Support custom detection engineering through data discovery, enrichment, normalization, and validation.
• Identify opportunities to elevate detections from low-level indicators toward higher-level behavioral and tradecraft-based detections using the Detection Stack.
• Partner with network engineering teams to evaluate technologies such as network sensors, NetFlow/IPFIX, DNS telemetry, proxy telemetry, firewall logs, IDS/IPS, packet capture, Zeek/network metadata, and NDR platforms.
• Establish telemetry health metrics, dashboards, and automated checks for missing, delayed, or malformed data.
• Assess network visibility across data centers, cloud environments, remote networks, and segmented environments.
• Optimize telemetry architectures and ingestion pipelines for performance, scalability, reliability, and cost.

Required Qualifications

• Bachelor’s degree in Cybersecurity or Information Technology.
• Active TS/SCI or SCI eligibility.
• 4+ years of experience in cybersecurity, enterprise security, or information security.
• 3+ years of experience supporting the implementation or administration of security technologies across enterprise environments.
• 3+ years of experience producing technical documentation, status reporting, or client deliverables for security engagements.

Technologies

SQL, Sigma, YARA-L, Python, SIEM, Detection Stack, NetFlow/IPFIX, IDS/IPS, Zeek, NDR, packet capture.

Location and Salary

• Location: Colorado Springs, CO (onsite)
• Salary: USD 95,600 - 159,300 per year

Benefits

• Eligible for a benefits package that is competitive for project delivery-focused professionals.
• You may be eligible to participate in a discretionary annual incentive program, subject to the program rules.

Preferred Qualifications

• Master’s degree in Cybersecurity, Information Technology, Information Systems, Engineering, or related field, with 10+ years of related experience.
• Experience supporting government or public sector clients.
• Experience with cloud security, data security, and network security.