Senior Cyber Engineer - Security Logging & Data Platforms

About the Company

About the Role

Responsibilities

• ● uild, operate and troubleshoot security telemetry pipelines from source systems through collection and processing platforms to storage, SIEM and downstream consumers.
• ● Engineer appropriate collection patterns for cloud, SaaS, on-premises, network, endpoint and application sources using technologies such as APIs, syslog/CEF, JSON, Event Hubs, Windows Event Collection and agent-based collection.
• ● Own complex onboarding and integration work end to end, including requirements, design, build, testing, production deployment, validation, documentation and transition into support.
• ● Diagnose failures across distributed pipelines and coordinate recovery across internal teams, platform providers and technology vendors.
• ● Ensure pipeline designs meet security, availability, performance, scalability and supportability requirements. 2. Logging platform engineering Provide hands-on engineering across Stream, Edge and Search, including routes, pipelines, functions, packs, event breaking, worker groups, fleet management, lookups and search use cases.
• ● Maintain platform health through monitoring, patching, upgrades, vulnerability remediation, capacity management, configuration control and performance tuning.
• ● Develop reusable patterns and automation that make onboarding, routing and operational support faster, safer and more consistent.
• ● Optimise data volumes and processing to improve platform efficiency and manage ingestion, storage and licensing costs without compromising agreed security outcomes.
• ● Support the controlled extension of Cribl capabilities to suitable data and observability use cases beyond traditional SIEM ingestion. 3. SIEM and security consumer enablement Engineer and support integrations into SIEM and other approved destinations, including long-term storage and search platforms.
• ● Monitor source, dataset and destination health and resolve issues affecting data availability, completeness, timeliness or usability.
• ● Work with SOC, RADAR, detection engineering, threat hunting and incident response stakeholders to translate security use cases into clear telemetry requirements.
• ● Validate that onboarded data supports intended detection, investigation and hunting outcomes before declaring delivery complete.
• ● Maintain clear accountability boundaries: enable high-quality security data and platform capability while partnering with the relevant teams that own detection content and operational response. 4. Data quality and data-as-a-product Apply and improve standards for parsing, normalisation, schema alignment, enrichment, filtering, metadata, routing and data validation.
• ● Ensure data is not merely ingested, but is understandable, trustworthy and actionable for its intended consumers.
• ● Define quality checks and acceptance criteria for new and changed sources, including completeness, field quality, timestamp handling, duplication, latency and routing accuracy.
• ● Create and maintain source ownership, design decisions, dependencies, support models and known limitations.
• ● Use customer feedback, operational evidence and platform metrics to improve the quality and value of security data products. 5. Operational engineering and service reliability Operate the logging and SIEM pipeline as a critical production capability, including health monitoring, incident response, problem management, root-cause analysis and service restoration.
• ● Plan and execute production changes, upgrades and releases in line with change-control requirements and with minimal disruption to dependent services.
• ● Develop and maintain dashboards, alerts, runbooks, troubleshooting guides, recovery procedures and support documentation.
• ● Contribute to resilience, continuity and recovery planning, and test that critical operational procedures work in practice.