Sr. Security Data Engineer (IV)

Full time - US-based - Remote / Hybrid

Lead the engineering and operational evolution of the security data platforms that power modern security operations and enable future autonomous security capabilities.

About the role :

We are rebuilding our security data architecture from the ground up. Not incrementally - fundamentally.

Over the next several years we are transitioning toward an agent-oriented security operating model where intelligent systems coordinate with human analysts to support detection, investigation, and response workflows. The security data platform is what makes that possible.

This is a senior-level hands-on engineering role focused on owning, scaling, and evolving the telemetry pipelines and operational data infrastructure that support security operations at enterprise scale. You will lead the implementation and operational maturity of critical telemetry systems while helping shape the engineering practices, reliability standards, and platform patterns used across the Security Data Engineering team.

You will operate with significant independence and technical ownership. You are expected to lead complex engineering efforts from design through production operation, drive reliability and scalability improvements, and serve as a senior technical resource for the team. While this is not an architecture governance role, you will contribute meaningfully to platform direction, implementation strategy, and technical decision-making.

You will work on systems that directly impact detection, investigation, and response capabilities.

When telemetry pipelines fail, analysts lose visibility. When telemetry quality degrades, detections become unreliable. Reliability, operational discipline, scalability, and engineering judgment matter deeply here.

You will partner closely with Detection Engineering, Security Operations, Red Team, Platform Engineering, and Security Architecture teams to ensure telemetry platforms remain operationally reliable, technically consistent, and capable of supporting both current workflows and future automation initiatives.

What you will do :

- Lead the design, implementation, and operational ownership of security telemetry pipelines across ingestion, normalization, enrichment, routing, storage, and delivery layers.

- Drive reliability, scalability, observability, and operational maturity improvements across critical security data infrastructure.

- Own complex telemetry onboarding and integration efforts across cloud, infrastructure, endpoint, network, identity, and application environments.

- Design and implement scalable normalization strategies, enrichment pipelines, schema management patterns, and telemetry quality controls.

- Lead troubleshooting and resolution efforts for complex production incidents, pipeline failures, performance bottlenecks, and telemetry quality issues.

- Optimize telemetry routing, storage tiering, retention strategies, and platform performance across security data systems.

- Build and improve operational tooling, dashboards, telemetry visualizations, and engineering automation that improve visibility and operational efficiency.

- Partner closely with Detection Engineering and Security Operations teams to ensure telemetry supports effective detection, investigation, and response workflows.

- Contribute to the evolution of the security data serving layer as the organization builds toward increasingly autonomous security operations.

- Drive operational improvements, engineering standards, automation initiatives, and telemetry quality efforts beyond immediate project responsibilities.

- Mentor and support other engineers across the team through technical guidance, troubleshooting support, operational best practices, and engineering collaboration.

- Participate in technical design discussions and contribute to long-term platform evolution and implementation strategy decisions.

- Continuously improve operational resilience, telemetry fidelity, engineering workflows, and platform maintainability across the security data ecosystem.

What you bring :

- Strong hands-on experience building and operating large-scale telemetry pipelines and distributed data systems in production environments.

- Deep understanding of security telemetry and operational datasets including logs, identity events, endpoint telemetry, cloud telemetry, vulnerability data, threat intelligence, and related security datasets.

- Hands-on experience operating technologies such as Cribl, Kafka, Fluent Bit, Vector, or equivalent telemetry and pipeline tooling at production scale.

- Strong experience with one or more large-scale data platforms such as Splunk, Elastic, Databricks, Snowflake, Chronicle, OpenSearch, or similar technologies.

- Strong understanding of schema design, normalization strategies, telemetry enrichment, data lifecycle management, and telemetry quality engineering.

- Experience designing and operating streaming architectures and near-real-time data processing systems at scale.

- Strong troubleshooting and operational instincts - you care deeply about telemetry integrity, reliability, operational visibility, and platform resilience.

- Strong scripting, automation, and infrastructure engineering skills using Python, Go, Bash, or similar languages.

- Ability to independently lead and execute complex engineering initiatives across ambiguous or evolving operational environments.

- Ability to make sound engineering tradeoffs involving scalability, reliability, maintainability, operational complexity, and performance.

- Clear and direct communication skills with the ability to explain technical decisions and operational tradeoffs across engineering and security teams.

- Experience mentoring engineers and contributing to engineering standards, operational maturity, and technical best practices.

- 8+ years of hands-on data engineering, platform engineering, or infrastructure engineering experience, including substantial experience in security-focused environments.

- Bachelors degree in Computer Science, Engineering, or equivalent practical experience.

What sets you apart :

- You understand why security telemetry differs fundamentally from traditional application observability data.

- You understand how telemetry quality, consistency, and operational reliability directly impact detection fidelity and investigative effectiveness.

- You have experience operating and scaling telemetry platforms where uptime, data integrity, and operational resilience materially affected security outcomes.

- You have strong opinions about schema design, normalization strategy, telemetry lifecycle management, and operational engineering practices - and you can explain the tradeoffs clearly.

- You contribute technical leadership through operational ownership, engineering standards, mentorship, and platform improvement initiatives.

- You think beyond individual systems and consider how engineering decisions impact platform scalability, maintainability, interoperability, and future operational evolution.

- You are curious about how automation and autonomous systems will consume and reason over security telemetry in the future.

- You are comfortable operating in fast-moving environments where many of the operational and engineering patterns are still evolving.

What this is not :

- This is not a traditional SIEM administration role.

- This is not a role focused solely on maintaining existing infrastructure.

- This is not a role where you simply execute predefined implementation tasks without engineering ownership.

- This is not a purely dashboard-building or reporting-focused position.

- This is not a role where the difficult telemetry quality, scaling, and operational reliability problems have already been solved.