Staff Security Logging Engineer

Kforce Inc is seeking a Staff-Level Security Logging Engineer to own and evolve their enterprise security logging and telemetry platform. This fully remote role is responsible for ensuring high-quality security data is collected and made actionable across various environments, while providing technical leadership and mentoring engineers.

Responsibilities:

• Own and evolve our enterprise security logging and telemetry platform
• Ensure high-quality, reliable security data is collected, normalized, retained, and made actionable across cloud, infrastructure, identity, network, and application environments
• Design and operate scalable logging pipelines that power threat detection, incident response, investigations, and compliance reporting
• Provide technical leadership
• Define logging standards
• Partner closely with Security Operations, Cloud, Infrastructure, and Application teams to ensure the right data exists when it matters most
• Architect centralized logging solutions
• Onboard critical data sources
• Improve log quality and consistency
• Optimize performance and cost
• Lead initiatives spanning cloud platforms, containerized workloads, identity systems, and enterprise security tools
• Mentor engineers
• Influence cross-team technical decisions

Requirements:

• 8+ years of experience in security engineering, platform engineering, SRE, or infrastructure roles
• Hands-on experience designing and operating enterprise-scale logging or SIEM platforms
• Strong understanding of log pipelines (collection, transport, parsing, normalization, enrichment, storage)
• Experience with cloud logging in AWS, Azure, or GCP
• Proficiency with scripting or programming (Python, Bash, Go, or similar)
• Deep knowledge of Linux/Windows systems and networking fundamentals
• Experience supporting security use cases such as detections, investigations, and incident response
• Ability to lead technical initiatives and influence across multiple teams in a remote environment
• Experience with tools such as Splunk, Microsoft Sentinel, Elastic, or Chronicle
• Familiarity with OpenTelemetry, Fluent Bit/Fluentd, Beats, or Syslog
• Kubernetes and container logging experience
• Knowledge of streaming platforms (Kafka, Kinesis, Event Hubs)
• Experience with compliance-driven logging (SOX, PCI, HIPAA, SOC2)
• Infrastructure-as-Code (Terraform or equivalent)
• Understanding of MITRE ATT&CK and modern threat detection concepts