Cyber Security Platform Engineer – Cyber Defense

Jobtailor; Deutschland; Vor Ort; EUR 100.000 - 140.000; Vollzeit

Zusammenfassung

Jobtailor is seeking an Architect and Engineer to design and deploy scalable, cloud-native SIEM solutions in Germany. You will build and optimize data pipelines to ingest, transform, and normalize security logs from diverse sources, ensuring high data fidelity and low latency.

The role involves writing custom parsers, integrating tools via REST APIs, and embedding security telemetry early in the SDLC. You will own the SIEM platform lifecycle, monitor health, and tune logs to reduce licensing

Qualifikationen

• Bachelor’s degree required.
• 6+ years software engineering experience.
• 2+ years designing scalable security data architectures.
• Experience configuring cloud‑native security & SIEM/SOAR platforms.
• Experience with security logging, data sources, log parsing & tuning.
• Experience administering cloud‑native security platforms.
• 2+ years on cloud native platforms, preferably GCP.
• Proficiency in Python, Go, Java, or Bash.
• CI/CD setup experience (OpenShift Tekton, GitHub Actions).
• Knowledge of secure coding practices and IaC tools.

Aufgaben

• Architect and engineer scalable, cloud-native SIEM solutions with IaC principles.
• Develop and maintain data pipelines to ingest, transform, and normalize security logs.
• Write and optimize custom parsers using Regex and scripting languages.
• Program integrations connecting third-party tools and streaming data sources to the SIEM via REST APIs and webhooks.
• Collaborate with DevOps and Applications teams to define logging standards and security telemetry in SDLC.
• Manage the full lifecycle of the SIEM platform including health monitoring and troubleshooting.
• Analyze ingestion volume and implement log tuning and exclusion rules to optimize licensing.
• Engineer automated provisioning workflows to manage infrastructure and IAM policies.

Kenntnisse

Architectural design

Cloud security

SIEM/SOAR platforms

Regex & parsing

IaC

CI/CD

Python/Go/Java

GCP

Networking security

REST APIs

Ausbildung

Bachelor’s degree in Computer Science, Cyber Security, Information Systems or related field

Tools

Terraform

Ansible

OpenShift Tekton

GitHub Actions

Jobbeschreibung

• Architect and engineer scalable, cloud-native SIEM solutions, utilizing Infrastructure-as-Code principles to manage log ingestion pipelines and storage.
• Develop and maintain robust data pipelines to ingest, transform, and normalize security logs from diverse endpoints (APIs, cloud platforms, firewalls) into the SIEM, ensuring high data fidelity and low latency.
• Write and optimize custom parsers using Regex and scripting languages to map raw log data to standardized security models, ensuring consistent data structures for analysis.
• Program custom integrations connecting third‑party tools and streaming data sources to the SIEM via REST APIs and webhooks.
• Collaborate with DevOps and Application teams to define logging standards and embed security telemetry requirements early in the software development lifecycle (SDLC).
• Manage the full lifecycle of the SIEM platform, including health monitoring, troubleshooting ingestion failures, and debugging parsing errors to ensure 24/7 availability.
• Proactively analyze ingestion volume against capacity limits to identify optimization opportunities, implementing granular log tuning and exclusion rules that minimize licensing costs and maximize the signal-to-noise ratio.
• Engineer automated provisioning workflows using Infrastructure as Code (IaC) to programmatically manage both the underlying infrastructure and complex IAM policies supporting the security platforms.

Requirements

• Bachelor’s degree in Computer Science, Cyber Security, Information Systems or related field.
• 6+ years of overall software engineering experience.
• 2+ years of technical experience designing and maintaining scalable security data architectures.
• Skilled in configuring cloud‑native security & SIEM/SOAR platforms.
• Experience with security logging, data sources, log parsing & tuning and industry best practices for log ingestion.
• Experience administering cloud‑native security platforms, with a specific focus on maintaining platform health, troubleshooting configuration issues, and managing complex IAM roles to ensure granular access control.
• 2+ years hands‑on development experience on cloud native platforms, preferably Google Cloud Platform.
• Even better, you may have...
• Proficiency in scripting languages like Python, Go, Java, or Bash for automation, data manipulation, and integration tasks.
• Hands‑on experience setting up CI/CD pipelines. OpenShift Tekton, or GitHub Actions or similar.
• Knowledge of secure coding practices.
• Experience setting up serverless functions using GCP Cloud Run or Cloud functions, and configuring the respective service for scaling.
• Robust knowledge of system design principles including reliability, availability, and scalability.
• Experience setting up logging and monitoring services (Dynatrace, GCP Ops Suites).
• Strong understanding of network security, log analysis, threat detection, and incident response.
• Knowledge of RESTful APIs, data integration techniques, and infrastructure-as-code tools (e.g., Terraform, Ansible).