Data Platform Engineer, Cybersecurity Operations

We are seeking a Data Platform Engineer with deep, specialized expertise in data platform architecture and engineering to build and operate the scalable data pipelines, storage backbones, and data lakes that power our next-generation cybersecurity operations capabilities. This role sits at the foundation of our security analytics capability, ingesting and normalizing massive volumes of SOC telemetry into modern, high-performance analytics platforms.

This is a deep technical architecture and platform engineering role. We are looking for someone who has genuinely mastered the craft of designing, scaling, and operating enterprise-grade data platforms — not a generalist engineer, but a specialist capable of making foundational architectural decisions that will shape how security data is stored, queried, and consumed for years to come.

• Pipeline Engineering:
  Design, build, and operate scalable, resilient, high-throughput data pipelines (batch and streaming) that ingest security relevant telemetry - logs, alerts, network flow data, endpoint events, identity signals, and cloud events - from across the enterprise.
• Data Normalization:
  Develop robust normalization and enrichment logic to transform heterogeneous SOC telemetry formats into standardized schemas consumable by downstream analytics and detection platforms.
• Storage Backbone Architecture:
  Architect and maintain the storage backbone (data lakes, warehouses, streaming stores) that serves as the durable, queryable source of truth for SOC data at enterprise scale.
• Data Lake Operations:
  Build and operate data lake infrastructure optimized for high-volume security telemetry, balancing cost, performance, retention, and query flexibility.
• Integration with Analytics Platforms:
  Ensure seamless, low-latency delivery of normalized SOC data into modern analytics platforms, SIEM/XDR tooling, and other downstream systems.
• Scalability & Performance Engineering:
  Continuously tune pipeline throughput, storage partitioning, and query performance to keep pace with growing telemetry volume and evolving analytics demands.
• Reliability & Observability:
  Implement monitoring, alerting, and self-healing capabilities to ensure pipeline uptime, data completeness, and data quality at production scale.
• Schema & Taxonomy Governance:
  Define and enforce data schemas, taxonomies, and metadata standards across ingested telemetry sources to enable consistent downstream consumption.
• Automation of Onboarding:
  Build reusable frameworks and automation to rapidly onboard new telemetry sources as the tool and sensor ecosystem expands.
• Security & Compliance:
  Ensure secure handling, encryption, access control, and regulatory compliance for sensitive security data throughout its lifecycle (ingestion, storage, processing, access).
• Cross-Functional Collaboration:
  
  Partner closely with cybersecurity operations analysts, detection engineers, threat and exposure management teams, and data science teams to ensure the platform meets operational and analytical needs.
• Documentation & Knowledge Transfer:
  Maintain clear architecture documentation, data dictionaries, and operational runbooks to support platform sustainability and team scalability.

• Deep, demonstrable expertise in data platform architecture and engineering - a proven track record of architecting and operating large-scale, mission-critical data platforms from the ground up, with strong judgment on trade-offs across scalability, cost, performance, and reliability.
• Extensive, hands-on experience building and operating large-scale data pipelines (batch and streaming) using technologies such as Cribl, Kafka, Spark, Flink, Airflow, or equivalent.
• Deep expertise in data lake and data warehouse…