Senior Security Data Engineer SIEM Data Pipeline

We are seeking four experienced Senior Security Data Engineers to lead the architecture, design, and implementation of scalable security telemetry ingestion and transformation pipelines as part of a major SIEM Modernization initiative.

The engineers will be responsible for orchestrating complex security data flows across 100+ existing and new cybersecurity data sources. The primary technologies for this initiative are Cribl and Vector, and hands-on experience with BOTH technologies is mandatory.

Candidates should have strong cybersecurity data engineering experience, with expertise in security telemetry ingestion, data normalization, transformation, enrichment, and delivery to downstream SIEM and analytics platforms., * Lead the architecture, design, and implementation of scalable, modular, and reusable data ingestion pipelines using Cribl and Vector.

• Develop platform-agnostic ingestion frameworks and reusable templates supporting multiple input sources, including Syslog, Kafka, HTTP, Event Hubs, and Blob Storage.
• Integrate data pipelines with downstream platforms such as Snowflake, Splunk, ADX, Log Analytics, and Anvilogic.
• Implement Open Cybersecurity Schema Framework (OCSF) strategies, including field mapping, transformation templates, and schema validation.
• Develop custom data transformations and enrichments using Python, JavaScript, Groovy, or other scripting languages.
• Implement filtering, enrichment, dynamic routing, and format conversions such as JSON, CSV, XML, and Logfmt.
• Establish secure data movement practices, including SSL/TLS, client authentication, input validation, and logging.
• Ensure end-to-end data traceability, lineage, metadata tagging, correlation IDs, and change tracking.
• Monitor ingestion pipelines, transformation failures, and data quality issues.
• Ensure reliable data delivery with minimal data loss, duplication, or transformation inconsistencies.
• Collaborate with cybersecurity, observability, analytics, and platform engineering teams.
• Maintain technical documentation covering ingestion patterns, transformation libraries, schema definitions, and data governance standards.

Security Information and Event Management (SIEM), Data Management, Security Information and Event Management (SIEM), Telemetry, Internet Security, Data Management, HTTP (HyperText Transport Protocol), Hubs, Splunk, Snowflake Schema, * 10+ years of experience in Cybersecurity.

• Hands-on production experience with BOTH Cribl AND Vector Mandatory.
• 5+ years of experience working with data ingestion and pipeline platforms.
• 5+ years of scripting experience using Python, JavaScript, Groovy, or similar languages.
• Strong understanding of SIEM platforms and security telemetry data ingestion.
• Experience designing and implementing data transformation, filtering, routing, and enrichment workflows.
• Experience working with structured and unstructured security log data.
• Must be a U.S. citizen., * Experience with Open Cybersecurity Schema Framework (OCSF).
• Experience with Splunk, Snowflake, ADX, Log Analytics, or Anvilogic.
• Knowledge of Kafka, Syslog, HTTP, Event Hubs, and Blob Storage.
• Experience with security data normalization, schema mapping, and validation.
• Experience supporting SIEM modernization initiatives.

Benefits: Danta offers a compensation package to all W2 employees that are competitive in the industry. It consists of competitive pay, the option to elect healthcare insurance (Dental, Medical, Vision), Major holidays and Paid sick leave as per state law.