Security Data Engineering

Security Data Engineering Jobs

4 jobs found

Today

Security Data Engineer

Deloitte Colorado Springs, CO

Colorado Springs, CO

Today

$96k - $159k/yr Full time Cybersecurity Operations Data Data Analysis

Apply Now

Job Description

Deloitte’s Enterprise Security team is seeking a Security Data Engineer to support clients with the design, implementation, and ongoing improvement of enterprise security solutions. This onsite role in Colorado Springs focuses on network-centric detection engineering, telemetry pipeline development, and reliable delivery of security data to SIEM and detection platforms.

Key Responsibilities

Design, write, and deploy high-fidelity detection rules using SQL, Sigma, YARA-L, or Python for network-based attack techniques such as C2 beaconing, data exfiltration, and lateral movement.
Continuously tune network detections to reduce false positives while preserving a strong signal-to-noise ratio.
Determine the telemetry needed to support network monitoring, threat hunting, incident response, and custom detection engineering.
Map detection needs to underlying data sources and identify visibility gaps across hybrid cloud and on-premises environments.
Design and maintain pipelines to ingest security telemetry from network, endpoint, identity, cloud, application, OT, and security infrastructure.
Ensure telemetry is delivered reliably to SIEM, data lake, analytics, and detection platforms; troubleshoot issues involving ingestion, parsing, latency, and data quality.
Assess whether packet, flow, session, DNS, proxy, authentication, endpoint, and application telemetry are sufficient for specific detection requirements.
Support custom detection engineering through data discovery, enrichment, normalization, and validation.
Identify opportunities to elevate detections from low-level indicators toward higher-level behavioral and tradecraft-based detections using the Detection Stack.
Partner with network engineering teams to evaluate technologies such as network sensors, NetFlow/IPFIX, DNS telemetry, proxy telemetry, firewall logs, IDS/IPS, packet capture, Zeek/network metadata, and NDR platforms.
Establish telemetry health metrics, dashboards, and automated checks for missing, delayed, or malformed data.
Assess network visibility across data centers, cloud environments, remote networks, and segmented environments.
Optimize telemetry architectures and ingestion pipelines for performance, scalability, reliability, and cost.

Required Qualifications

Bachelor’s degree in Cybersecurity or Information Technology.
Active TS/SCI or SCI eligibility.
4+ years of experience in cybersecurity, enterprise security, or information security.
3+ years of experience supporting the implementation or administration of security technologies across enterprise environments.
3+ years of experience producing technical documentation, status reporting, or client deliverables for security engagements.

Technologies

SQL, Sigma, YARA-L, Python, SIEM, Detection Stack, NetFlow/IPFIX, IDS/IPS, Zeek, NDR, packet capture.

Location and Salary

Location: Colorado Springs, CO (onsite)
Salary: USD 95,600 - 159,300 per year

Benefits

Eligible for a benefits package that is competitive for project delivery-focused professionals.
You may be eligible to participate in a discretionary annual incentive program, subject to the program rules.

Preferred Qualifications

Master’s degree in Cybersecurity, Information Technology, Information Systems, Engineering, or related field, with 10+ years of related experience.
Experience supporting government or public sector clients.
Experience with cloud security, data security, and network security.

View full job page →

5d ago

Senior Security Engineer- Security Operations

GE Appliances Louisville, KY

Louisville, KY

5d ago

Full time Senior Cloud Platforms Cybersecurity Operations

Apply Now

Job Description

GE Appliances is hiring a Senior Security Engineer to lead Security Operations detection and response engineering for enterprise IT and manufacturing environments.

Responsibilities

Act as the senior technical lead and subject-matter expert for security operations, owning detection and response platform architecture, configuration, and operational health; set technical standards used by the MSSP.
Design, build, test, and maintain detection content including correlation rules, behavioral analytics, and IOC/BIOC rules mapped to MITRE ATT&CK; manage the full detection lifecycle using detection-as-code practices (version control, testing, peer review, documentation).
Own telemetry coverage by identifying visibility gaps and onboarding, parsing, and normalizing log sources across endpoints, identity, Microsoft 365, cloud, network, email, DLP, and OT; monitor ingestion health and manage data volume and retention cost.
Engineer security automation and orchestration (SOAR) playbooks and integrations that enrich alerts, automate containment, and connect security tooling with IT service management and collaboration platforms to reduce manual effort and MSSP handling time.
Provide technical oversight of MSSP output in partnership with the Information Security leader owning the MSSP commercial relationship, including:
- Review triage and investigation quality, escalation accuracy, and run-book adherence.
- Drive false-positive reduction and tuning.
- Update MSSP run books and playbooks as detections and the environment change.
Serve as Tier 3 escalation for complex or high-severity incidents escalated by the MSSP; perform hands-on investigation, endpoint and log analysis, scoping, and containment; coordinate with the external incident response retainer when engaged.
Lead hypothesis-driven threat hunting informed by threat intelligence and threats targeting manufacturing; convert hunt outcomes into durable detections and hardening recommendations.
Operationalize threat intelligence by translating advisories, vulnerability disclosures, and adversary reporting into detections, hunts, and blocking actions; track relevant threat actors for GE Appliances.
Validate detection and response effectiveness using purple-team exercises, adversary emulation, and breach-and-attack simulation; measure coverage against MITRE ATT&CK and confirm MSSP detection and response.
Maintain EDR/XDR platform health across endpoint and server estate, including agent coverage, prevention and exploit-protection policies, exclusions governance, and response actions.
Strengthen vulnerability operations run by the MSSP: scan coverage (including authenticated scanning), risk-based prioritization using exploitability and threat intelligence (e.g., CISA KEV, EPSS), correlate vulnerabilities with active threat activity, and automate remediation workflows.
Partner with Cloud, Network, and Identity security engineers to integrate cloud security posture (CNAPP), network, and identity signals into detection and response, including identity threat detection for account takeover, MFA fatigue, and AiTM phishing.
Partner with OT Security to extend monitoring and detection into manufacturing environments safely for production and consistent with ISA/IEC 62443 and NIST SP 800-82.
Author and maintain incident response playbooks and technical run books; lead the technical portion of post-incident reviews and drive corrective actions to closure.
Define, automate, and report operational metrics and KPIs (e.g., MTTD, MTTR, ATT&CK detection coverage, false-positive rate, log source health, MSSP escalation quality) to the CISO and Information Security leadership.
Contribute to the security operations roadmap by evaluating emerging capabilities (including AI-assisted triage and agentic SOC automation) and supporting platform evaluations, proofs of concept, and TCO analyses.
Provide technical evidence for logging, monitoring, and incident response controls in SOX, C-SOX, PCI-DSS, and other audits; drive remediation of related findings.
Mentor engineers and transfer knowledge to MSSP analysts on the GE Appliances environment, detections, and response procedures.

Requirements

Bachelor’s degree in Information Systems, Cybersecurity, Computer Science, or related technical field, or equivalent practical experience.
6–10 years progressive experience in IT or information security, including 4+ years hands-on experience in security operations, detection engineering, or incident response in a large enterprise environment.
Deep hands-on experience engineering and administering SIEM/SOAR and EDR/XDR platforms (e.g., Palo Alto Networks Cortex XSIAM/XDR, Splunk, Microsoft Sentinel/Defender, CrowdStrike), including writing detection rules/queries (e.g., XQL, SPL, KQL).
Proven experience building detection content mapped to MITRE ATT&CK and tuning it for fidelity at enterprise scale.
Experience building SOAR playbooks and integrations; proficiency in Python and/or PowerShell; working with REST APIs and JSON.
Hands-on incident response experience with significant enterprise incidents such as ransomware, BEC, and account takeover, including endpoint, log, and network analysis.
Experience in a technical oversight role working with an MSSP/MDR, including tuning, escalation quality review, and run-book development.
Strong understanding of log sources and telemetry across Windows, Linux, network, cloud (AWS, Azure, and/or GCP), Microsoft 365, and identity providers.
Working knowledge of MITRE ATT&CK, NIST SP 800-61, NIST CSF, and CIS Controls.
Excellent verbal and written communication skills with the ability to communicate with technical and executive audiences.

Technologies

Palo Alto Networks Cortex XSIAM/XDR, Splunk, Microsoft Sentinel/Defender, CrowdStrike
XQL, SPL, KQL
Python, PowerShell, REST APIs, JSON
MITRE ATT&CK, SOAR, SIEM, EDR, XDR
Microsoft 365, CNAPP
CISA KEV, EPSS
ISA/IEC 62443, NIST SP 800-82, NIST SP 800-61, NIST CSF, CIS Controls
SOX, C-SOX, PCI-DSS
Detection-as-code, Git, Sigma, Atomic Red Team, MITRE Caldera

Preferred qualifications

Certifications: GIAC (GCIH, GCIA, GCDA, GCFA, GCTI), Palo Alto Networks Cortex certifications, CISSP, or similar.
Experience with detection-as-code practices, Git, CI/CD pipelines, and vendor-neutral rule formats such as Sigma.
Experience with threat hunting, purple teaming, and adversary emulation tools (Atomic Red Team, MITRE Caldera, breach-and-attack simulation platforms).
Familiarity with OT/ICS monitoring frameworks such as ISA/IEC 62443 or NIST SP 800-82.
Experience integrating cloud security (CNAPP/CSPM) and identity telemetry into detection and response.
Experience applying AI and large language models to security operations; familiarity with AI security frameworks such as MITRE ATLAS and the OWASP Top 10 for LLM Applications.
Experience in manufacturing, critical infrastructure, or global multinational organizations.

Working conditions

Normal office environment.
Occasional weekend and/or evening work; after-hours escalation for major security incidents and participation in an on-call rotation.

Location

Louisville, KY (onsite), USA

View full job page →

8d ago

Data Engineer III - Python, Databricks

JPMorganChase Houston, TX

Houston, TX

8d ago

Full time Python Amazon Web Services AWS

Apply Now

Job Description

Join a Houston, TX onsite team designing and delivering secure, stable, scalable data collection, storage, access, and analytics solutions.

Responsibilities

Build ELT pipelines and data workflows using Python and Databricks
Use SQL frequently; apply strong understanding of NoSQL databases
Implement data security via entitlements frameworks
Update logical and physical data models as new use cases emerge
Support review of controls to ensure sufficient protection of enterprise data
Apply reuse-first, AI-assisted practices to strengthen data pipeline SDLC quality (for example, test generation and control validation)
Ensure traceability/auditability and alignment to resiliency and security expectations
Leverage enterprise-authorized AI capabilities to accelerate data pipeline and design analysis and documentation
Validate AI-assisted outputs and handle data according to sensitivity and security requirements
Review and validate AI-assisted suggestions (such as query ideas, test ideas, or model change summaries) before use; escalate when uncertain

Requirements

3+ years of applied experience with software engineering concepts (formal training or certification required)
Working knowledge of AWS, Databricks, and Python across the data lifecycle
Advanced SQL skills including joins and aggregations
Working understanding of NoSQL databases
Significant experience with statistical data analysis and choosing appropriate tools and data patterns
Ability to utilize AWS Cloud Services to develop, deploy, and manage applications at scale
Proficiency in AI coding assistants, with daily use of tools such as Cursor, GitHub Copilot, and Claude for code generation, documentation, and refactoring
Effective prompt engineering: provide context, clear goals, relevant source material, and defined output expectations to produce accurate, usable code
Critical evaluation and validation of AI-generated code, including identification of hallucination patterns, security vulnerabilities, and logic errors prior to production deployment
Demonstrated experience using enterprise-authorized AI capabilities within the work environment, with strong validation habits and awareness of data sensitivity

Technologies

Python, Databricks, ELT
SQL, NoSQL
AWS, AWS Glue Jobs, Federated Data Lake
Cursor, GitHub Copilot, Claude
Aurora Postgres, MongoDB
Medallion architecture
Docker, CI/CD
JavaScript, Java

Benefits

Comprehensive health care coverage
On-site health and wellness centers
Retirement savings plan
Backup childcare
Tuition reimbursement
Mental health support
Financial coaching

Preferred Qualifications, Capabilities, and Skills

Familiarity with standardized data layer practices (Medallion architecture)
Exposure to Aurora Postgres and MongoDB
Experience developing and supporting AWS Glue Jobs and Federated Data Lake
Skills designing efficient data models, including normalization, denormalization, and schema design; experience with relational and star schemas
Augmented development workflow using CI/CD, Docker, and AI to bridge language gaps (for example, transitioning between Python, JavaScript, or Java)

View full job page →

8d ago

Cybersecurity Data Engineering Manager

Capital Group Companies New York, NY

New York, NY

8d ago

$173k - $342k/yr Full time Manager Analytics Cloud Data Engineering

Apply Now

Job Description

Capital Group Companies is hiring a Cybersecurity Data Engineering Manager in New York, NY. This onsite role focuses on creating and delivering the organization’s cybersecurity analytics and security intelligence capabilities, with a strong emphasis on SIEM engineering and enterprise-scale security data pipelines.

In this position, you will lead a team working across security telemetry, operational data, threat and vulnerability information, cloud security signals, identity data, and business context. The goal is to convert those inputs into actionable intelligence that supports data-driven decisions and helps reduce risk to the firm.

Responsibilities

Define and execute the cybersecurity analytics, security data engineering, and security intelligence strategy for the organization.
Lead a team of cybersecurity data scientists, data engineers, and security engineers to transform security telemetry, operational data, threat intelligence, vulnerability data, cloud security signals, identity data, and business context into actionable intelligence for data-driven decision-making.
Emphasize SIEM engineering and the operation of enterprise-scale security data pipelines, including data models and dashboards.
Manage data ingestion and integration frameworks and build advanced analytics and reporting to reduce risk to the firm.

Requirements

Proven leadership of data scientists, data engineers, or security data professionals.
Demonstrated ability to lead large, complex programs with significant organizational impact.
Strong stakeholder influence and consensus-building with senior leadership.
Deep knowledge of cybersecurity principles, cyber risk measurement, security operations, threat detection, vulnerability management, cloud security, and security telemetry.
Expertise in statistical modeling, machine learning, predictive analytics, anomaly detection, and behavioral analytics.
Strong understanding of cybersecurity KPIs, KRIs, operational metrics, and risk analytics frameworks.
Deep expertise building large-scale data pipelines, streaming architectures, and data integration platforms.
Extensive experience designing security-focused data models and analytical data structures.
Experience managing enterprise-scale security telemetry and observability platforms.
Strong understanding of data governance, metadata management, lineage, quality management, and regulatory requirements.
Expertise in cloud-native data architectures and modern data platform design.
Proficiency in Python and SQL.
Experience with cloud native technologies such as AWS, Snowflake, Databricks, or similar.
Experience with observability technologies like Cribl, Fluentd, OTEL, or similar.
Experience with dashboarding and visualization technologies.
Strong understanding of cloud infrastructure, distributed computing, and enterprise-scale analytics environments.
Experience building and managing security data platforms including SIEM, security data lakes, observability platforms, and threat intelligence systems.
12+ years of experience in cybersecurity analytics, data science, data engineering, security operations, or related disciplines.
Bachelor’s degree in Cybersecurity, Computer Science, or a related field.
5+ years leading technical teams.
Experience building security data lakes and enterprise-scale security analytics platforms.
Experience supporting AI-enabled security initiatives and cyber risk measurement programs.
Experience supporting executive reporting, regulatory examinations, and audit requirements.

Technologies

Python, SQL
AWS, Snowflake, Databricks
Cribl, Fluentd, OTEL
SIEM
Security data lakes, observability platforms, threat intelligence systems
Dashboarding and visualization technologies

Benefits

Generous time-away and health benefits from day one, with the opportunity for flexible work options.
2-for-1 matching gifts for charitable contributions and the opportunity to secure annual grants for organizations you love.
Access to on-demand professional development resources.
Competitive salary, bonuses and benefits.
Company-funded retirement contribution, including a retirement plan where Capital contributes 15% of eligible earnings.
Individual annual performance bonus plus Capital’s annual profitability bonus, factoring into retirement contributions.

Compensation: USD 173,072 - 342,072 per year.

View full job page →

Security Data Engineering Jobs

Security Data Engineer

Senior Security Engineer- Security Operations

Data Engineer III - Python, Databricks

Cybersecurity Data Engineering Manager

Get Security Data Engineering Jobs alerts