Senior CyberTech Engineer (Specialist - Data Sciences)

About the role

This role requires a senior BFT CyberTech Engineer with deep hands-on expertise in modern cloud-native security platform engineering spanning SIEM, data pipeline, data lake and SOAR technologies. The consultant will be a critical technical contributor in delivering a Unified AI-Driven SOC capability: a federated, broad-capability query and orchestration system that unifies SOC operations, threat intelligence, log management, incident case management and broader security data underpinned by a configurable AI agent layer for incident and event investigation.

Responsibilities

• Cloud Native SIEM Engineering: Architect, deploy and operate modern cloud-native SIEM platforms (e.g., Google Chronicle, Microsoft Sentinel, Elastic SIEM or equivalent) at enterprise scale.
• Design and implement federated query capabilities enabling broad cross-domain search across SOC intelligence, log management and case management data sources.
• Develop and maintain detection content, correlation rules and dashboards aligned to SOC operational requirements and threat use cases.
• Optimize SIEM performance, data tiering and retention strategies to balance cost, coverage and query fidelity.
• Data Pipeline Engineering (Cribl): Design, build and manage enterprise-grade data pipelines using Cribl Stream and/or Cribl Edge for log routing, enrichment, transformation, filtering and normalization at scale.
• Implement Cribl-based data management strategies to optimize data volume, reduce ingest costs and ensure high-fidelity event delivery to SIEM and data lake destinations.
• Develop Cribl pipelines that support multi-destination routing across SIEM, data lake and cold storage tiers.
• Collaborate with detection engineering and threat intelligence teams to enrich pipeline data with contextual security signals.
• Security Data Lake Engineering: Architect and manage a scalable cloud-native security data lake (e.g., on AWS S3/ Athena, GCP BigQuery or Snowflake) for long-term log retention, threat hunting and AI/ML workloads.
• Develop data models, schemas and partitioning strategies optimized for security analytics and federated query performance.
• Enable broad-capability query access across SOC intel and incident data stored within the data lake, supporting both real-time and retrospective investigation workflows.
• Integrate data lake telemetry with SIEM and SOAR platforms to support unified investigation and orchestration.
• SOAR Platform Engineering: Design, deploy and maintain SOAR platform infrastructure (e.g., Palo Alto XSOAR, Splunk SOAR, Google SecOps SOAR or equivalent) to enable automated incident response and orchestration workflows.
• Build and maintain SOAR playbooks and integrations that span SOC case management, threat intelligence, SIEM ingestion and external security tooling.
• Engineer orchestration workflows that leverage AI agent capabilities for automated event triage, enrichment and investigation recommendations.
• Continuously improve SOAR operational efficiency through playbook tuning, integration maintenance and metric-driven optimization.
• AI-Driven SOC Enablement: Contribute to the design and implementation of a configurable AI agent layer for incident and event investigation integrating with SIEM, SOAR, data lake and case management systems.
• Engineer the data and API connectivity required to support AI agent queries, context retrieval and automated investigation workflows across federated SOC data sources.
• Collaborate with data science/AI/ML engineering and detection engineering teams to operationalize AI-driven investigation and triage capabilities within the SOC platform.
• Support the evaluation and integration of emerging AI/GenAI security operations tooling aligned to the unified SOC vision.
• Platform Integration & Federated Architecture: Design and implement integration patterns that connect SIEM, data pipeline, data lake, SOAR and case management platforms into a cohesive federated SOC data fabric.
• Develop and maintain APIs, webhooks and data connectors to ensure seamless interoperability across the SOC technology ecosystem.
• Apply cloud-native engineering best practices (IaC, CI/CD, containerization) to SOC platform deployment, configuration management and operational scaling.

Required Skills and Experience

• Experience: 7 years in cybersecurity or security platform engineering with demonstrable hands-on experience across SIEM, data pipeline, data lake and SOAR technologies in enterprise environments.
• SIEM: Deep expertise in one or more modern cloud-native SIEM platforms (Google Chronicle, Microsoft Sentinel, Elastic SIEM or equivalent). Experience with federated search, data normalization (e.g., UDM, OCSF) and large-scale detection content management.
• Data Pipeline (Cribl): Strong hands-on proficiency with Cribl Stream and/or Cribl Edge for enterprise log management, routing, enrichment and transformation. Experience designing multi-destination Cribl pipelines across SIEM, data lake and other destinations.