Cyber Security Data Engineer

eTeam is seeking a Cyber Security Data Engineer to join their Cyber Security Operations team. The role involves building and maintaining security data pipelines and collaborating with various teams to ensure data integrity and compliance for threat detection and incident response.

Responsibilities:

• Design, build, and maintain scalable data ingestion pipelines for onboarding security log sources into SIEM and cloud data platforms, including Azure Data Explorer and Log Analytics
• Parse, normalize, transform, and enrich structured and unstructured log data using techniques such as regex, JSON parsing, schema mapping, and data validation
• Partner with application owners, infrastructure teams, cloud teams, vendors, and security stakeholders to onboard new log sources and confirm end-to-end data flow
• Validate log integrity, completeness, timeliness, and quality to ensure security telemetry is reliable and fit for monitoring, detection, response, and reporting use cases
• Align onboarded data to organizational standards, schemas, naming conventions, and data governance expectations to support downstream analytics and automation
• Troubleshoot ingestion, parsing, transformation, and pipeline issues across diverse log sources, platforms, and environments
• Develop and maintain documentation for log onboarding procedures, data mappings, source requirements, pipeline configurations, and operational support processes
• Collaborate with detection engineering and SOC teams to ensure onboarded logs support threat detection, investigation, response, and cyber risk visibility requirements
• Conduct telemetry gap analysis to identify missing, incomplete, or underrepresented data sources and recommend onboarding priorities to improve security coverage
• Support logging and data collection practices that align with regulatory, audit, compliance, retention, and integrity requirements
• Improve ingestion frameworks, automation, and onboarding workflows to increase efficiency, repeatability, scalability, and cost effectiveness
• Support infrastructure-as-code, scripting, and automation approaches where appropriate to streamline deployment and ongoing maintenance
• Monitor pipeline performance and partner with stakeholders to optimize ingestion reliability, throughput, and cost efficiency
• Stay current on emerging logging standards, telemetry formats, cybersecurity data engineering practices, and cloud security data platform capabilities

Requirements:

• Minimum of 3 years of relevant experience in cybersecurity, data engineering, log management, security operations, or a related technology discipline
• Hands-on experience onboarding, managing, and validating log sources in SIEM, cloud data platforms, or security analytics environments
• Strong understanding of data parsing, normalization, transformation, and validation techniques, including regex, JSON, XML, CSV, and structured and unstructured data handling
• Familiarity with common security telemetry sources, including network, endpoint, identity, application, cloud, and infrastructure logs
• Experience with cloud platforms and associated logging, monitoring, and analytics services
• Strong troubleshooting and problem-solving skills related to data pipelines, ingestion flows, schema issues, and data quality defects
• Understanding of compliance and regulatory expectations related to logging, retention, auditability, and data integrity
• Ability to plan, coordinate, and execute onboarding efforts across multiple internal teams, vendors, and stakeholders
• Ability to balance operational support responsibilities with project-based delivery and continuous improvement efforts
• Strong attention to detail, commitment to data quality, and ownership of outcomes
• Ability to work effectively and collaboratively in a global team environment
• Strong communication skills, sound judgment, and a high degree of accountability
• Experience with scripting or automation tools such as Python, PowerShell, or similar technologies is preferred
• Experience in broader cybersecurity disciplines, including threat detection, incident response, vulnerability management, or cloud security, is a plus