Senior Security Engineer – Data Pipeline & Observability - Mid-Atlantic region (Remote)

GuidePoint Security provides trusted cybersecurity expertise, solutions and services that help organizations make better decisions and minimize risk. In this role you will work directly with vendor partners and account teams, design and build the pipelines that fix clients' SIEM cost, data inconsistency, and platform migration problems, and explain the cost and security trade-offs to the people who pay for them. The role sits within the Mid-Atlantic SecOps practice, focused on data integration, normalization, quality, routing, retention, and platform optimization. Up to 15% travel. Sedentary work. Applicants must be authorized to work for any employer in the U.S.; sponsorship is not available for this role.

Responsibilities

Architect, deploy, and optimize telemetry pipelines with Cribl Stream, Edge, Lake, and Search, and comparable platforms; Onboard, parse, and normalize data from syslog, agents, cloud provider logs, SaaS APIs, identity, EDR, and network sources into common schemas; Build reduction, filtering, enrichment, and tiering strategies; Quantify business cases of baseline ingest, model savings, and present before and after results; Brief client senior leadership (CISO, CIO, CFO) on findings, progress, and recommendations; Size and harden deployments, including high availability, disaster recovery, and fleet health monitoring; Build governance into the data flow with masking and redaction, role-based access control, TLS/PKI, and retention policy; Lead the data workstream of SIEM and platform migrations; Deliver pipeline health checks and optimization assessments with prioritized roadmaps; Support pre-sales by joining scoping calls, estimating level of effort, and contributing to statements of work; Work with vendor partner engineering teams on joint delivery, escalations, and product feedback; Work alongside Detection & Response and Automation & AI engineers; Serve as the technical point of contact on engagements, with progress reporting, as-built documentation, runbooks, and knowledge transfer; Contribute to practice intellectual property and mentor other engineers

Requirements

5+ years in cybersecurity, IT operations, or data engineering, including 3+ years building and running production telemetry pipelines; Hands-on production experience with Cribl Stream or a comparable pipeline platform; Working knowledge of at least one SIEM or analytics destination (Splunk, Elastic, Microsoft Sentinel, Google SecOps, CrowdStrike, or SentinelOne); Client-facing delivery experience as a consultant with a services firm, VAR, systems integrator, MSSP, or vendor professional services team, or an equivalent internal role delivering to multiple business units; Linux administration and networking fundamentals (syslog over TCP/UDP/TLS, load balancing, firewalls), plus logging services in at least one cloud (AWS, Azure, or GCP); Scripting and data skills: JavaScript, Python, or Bash; regular expressions; REST APIs; JSON, key-value, CSV, and XML formats; Ability to engage senior leadership and translate technical work into business terms, in writing and in person; Cribl Certified User and Cribl Certified Admin (Stream), held at hire or earned within 90 days; Embraces emerging technologies, including AI tools

Nice to have

Experience at a VAR, systems integrator, or MSSP working within vendor partner programs; Technical writing experience: assessment reports, executive summaries, architecture and as-built documents, and roadmaps; Delivery experience on more than one pipeline platform; Cribl Certified Admin (Edge); Splunk Certified Admin or Architect; Elastic Certified Engineer; SentinelOne AI Data Pipelines; cloud certifications (AWS, Azure, GCP); Kubernetes and containers; Terraform or Ansible; Git and CI/CD for pipeline configuration as code; Kafka, object storage and data lakes, and Snowflake or Databricks as destinations; OpenTelemetry for metrics and traces; Familiarity with MITRE ATT&CK data sources; Regulated or federal environments (HIPAA, PCI DSS, FedRAMP, CMMC, FIPS); ability to obtain a U.S. security clearance is a plus

Benefits

Group Medical Insurance options (Zero Deductible PPO Plan or High Deductible Health Plan with HSA, with employer contributions); Group Dental Insurance with employer-paid premiums; 12 corporate holidays and a Flexible Time Off (FTO) program; Healthy mobile phone and home internet allowance; Eligibility for retirement plan after 2 months at open enrollment; Pet Benefit Option