Cybersecurity Data Engineer - Security Telemetry & Azure

Join the cybersecurity operations organization of a global financial institution focused on strengthening its monitoring, threat detection, incident response, and cyber-risk visibility capabilities. This collaborative, globally distributed team works across security, cloud, infrastructure, application, and governance functions to protect complex technology environments operating under rigorous regulatory standards.

The team is advancing its security data ecosystem by developing reliable, scalable pipelines for cloud and on-premises telemetry. This role will contribute directly to improving data quality, expanding security monitoring coverage, and enabling faster, more accurate threat detection and investigation.

What’s In Store For You

• Remote work arrangement.
• W2 engagement only; C2C and 1099 arrangements are not available.
• Opportunity to build security data solutions supporting a complex global enterprise.
• Exposure to Azure security analytics platforms, SIEM technologies, and large-scale cybersecurity telemetry.
• Collaboration with cybersecurity operations, detection engineering, cloud, infrastructure, application, and governance teams.
• Hands-on involvement in improving security monitoring coverage, automation, and data governance.

How You Will Make An Impact

• Design, develop, and maintain scalable pipelines that ingest security telemetry into SIEM and cloud analytics platforms.
• Onboard network, endpoint, identity, application, infrastructure, and cloud log sources.
• Parse, normalize, transform, and enrich structured and unstructured log data using regex, JSON, XML, CSV, schema mapping, and validation techniques.
• Partner with application owners, infrastructure teams, cloud teams, vendors, and cybersecurity stakeholders to establish complete end-to-end data flows.
• Verify the completeness, accuracy, timeliness, and integrity of security telemetry used for monitoring and incident response.
• Align onboarded data with enterprise schemas, naming conventions, governance standards, and downstream analytics requirements.
• Troubleshoot ingestion failures, parsing errors, schema conflicts, transformation issues, and data-quality defects.
• Collaborate with SOC and detection engineering teams to ensure data sources support investigation and threat-detection use cases.
• Conduct telemetry gap assessments and recommend data-source priorities that improve cybersecurity coverage.
• Develop documentation covering source requirements, data mappings, pipeline configurations, onboarding procedures, and support processes.
• Improve automation and reusable ingestion frameworks to make onboarding more efficient, scalable, and cost-effective.
• Monitor pipeline health, throughput, reliability, and consumption costs.
• Support scripting and infrastructure-as-code practices used to deploy and maintain security data integrations.
• Ensure logging and retention practices support regulatory, audit, compliance, and data-integrity expectations.

Do You Bring Proven Success in Security Data Engineering and Log Pipeline Development?

• At least three years of relevant experience in cybersecurity engineering, data engineering, security operations, log management, or a related technical discipline.
• Hands-on experience onboarding, managing, and validating log sources within SIEM, security analytics, or cloud data platforms.
• Experience with Microsoft Azure services such as Azure Data Explorer, Azure Monitor, or Log Analytics.
• Strong understanding of security data ingestion, parsing, normalization, transformation, enrichment, and validation.
• Proficiency handling structured and unstructured formats, including JSON, XML, CSV, and raw text logs.
• Practical experience using regular expressions and schema-mapping techniques.
• Familiarity with telemetry generated by network, endpoint, identity, cloud, infrastructure, and application technologies.
• Ability to troubleshoot pipeline failures, ingestion delays, missing events, schema inconsistencies, and data-quality issues.
• Familiarity with query languages used to investigate and validate security telemetry; Kusto Query Language experience is strongly preferred.
• Experience using Python, PowerShell, or comparable scripting and automation technologies is preferred.
• Understanding of logging requirements involving retention, auditability, regulatory compliance, and data integrity.
• Ability to coordinate technical onboarding activities involving multiple teams, vendors, and stakeholders.
• Strong attention to detail, accountability, problem-solving ability, and commitment to data quality.
• Experience with threat detection, incident response, vulnerability management, cloud security, or broader SOC operations is advantageous.
• Strong written and verbal communication skills with the ability to work effectively across global teams.