Senior Data and Security Engineer

Department: Technology

Employment Type: Permanent

Location: Any UK Office Hub (Bristol / London / Manchester / Swansea)

Compensation: £55,000 - £85,000 / year

Made Tech is seeking a Senior Security and Data Engineer to join our Cyber Practice. This is a technical delivery position, designed for an individual who excels at the intersection of security engineering, data management, and operational compliance. You will play a vital role in ensuring that the services millions of people rely on are secure, resilient, and built to rigorous standards.

The core mission of this role is to bridge technical execution with operational compliance while working effectively alongside UK Government Civil Servants. You will be responsible for delivering security engineering within a Security Operations Centre (SOC) environment, translating complex technical requirements into actionable data flows to support detections and alerts. The position maintains a dual focus: hand‑on security engineering, including SIEM and detection logic development, and streaming data engineering;

specifically, the optimisation and manipulation of high-volume streaming data pipelines. You will support outcomes so that high‑quality security engineering is an enabler of delivery rather than a bureaucratic hurdle.

• Pipeline Optimisation & Enrichment: Manage log ingestion pipelines on a Cribl cloud platform. You will intelligently help route, collate, filter, and normalise logs, ensuring data is tagged as soon as possible and enriched at the edge.
• AWS Cloud Telemetry Integrity: Support the end-to-end flow of AWS security telemetry (Cloud Trail management and data events, VPC Flow Logs, Guard Duty findings, EKS/container audit logs, and IAM activity) into the centralised log architecture.
• Stream Processing & Pipeline Optimisation (Cribl Stream): Leverage stream processing (ideally Cribl) to parse, route, mask sensitive fields, and filter out high-volume, low-value debug noise before indexing into Splunk to maximise detection visibility.
• Data Normalisation: Build and maintain efficient Splunk data models, accelerated searches, and field extractions mapped to OCSF, ensuring fast query performance and portable detection logic.
• Troubleshooting Pipeline Bottlenecks: Diagnose and resolve systemic transport failure modes: SQS/S3 ingestion lag, universal forwarder dropouts, unparsed JSON structures, Cribl pipeline back pressure, and source type schema mismatches.
• Advanced Log Management: Optimise log sources by summarising Net Flow data, trimming bulk data to remove unnecessary payloads, deduplicating identical logs, and pre-parsing complex regex strings.
• Storage Architecture: Manage real‑time streaming technologies (e.g., Kinesis) and security data storage solutions including S3 buckets and Amazon Security Lake.
• Data Tiering: Support the classification of data into appropriate storage tiers—Hot (security events), Warm (application and performance), and Cold (compliance)—to reduce volume overhead and optimise costs.
• Secure Ingestion: Verify that all data in transit and at rest is fully encrypted (KMS & TLS). Ensure all fields are normalised into standard schemas (OCSF) while enforcing least‑privilege access controls.

• SIEM & EDR Logic Development: Support analysts in the creation and tuning of detection rules across platforms.
• Detection Quality Assurance: Act as an enabler to establish and maintain regular monitoring cycles for detection rules, helping calculate Signal-to-Noise Ratios and rule trust scores to ensure high‑fidelity alerting.

• Cloud Platforms: Proven hand‑on experience designing and securing cloud…