Cyber Data Engineer

Bounteous; Glasgow; On-site; GBP 60,000 - 90,000; Full time

Job summary

Bounteous is recruiting a Cyber Data Engineer to build and maintain CyberELK, an Elasticsearch-based data platform, in Glasgow. The role focuses on onboarding data sources, building automation, and optimizing cluster performance within a security analytics context.

Successful candidates will work with cyber teams including security response, investigations and insider threat, applying strong troubleshooting and DevOps skills in a collaborative setting.

Qualifications

• Experience deploying and managing Elasticsearch platforms in production.
• Experience with Elastic Stack ingest/pipeline tooling (Logstash/Beats).
• Experience with data pipelines on major Cloud Service Providers (GCP/AWS/Azure).
• Automation using Python and Ansible.
• Strong OS/Networking understanding (Linux/Unix, HTTP, encryption).
• Version control and DevOps tooling (Git/Jenkins/Jira).
• Strong analytical and troubleshooting skills.
• Familiarity with Agile/Kanban.

Responsibilities

• Onboard data sources into CyberELK with ECS mapping.
• Develop automation tools that integrate with in-house CMF and APIs.
• Tune Elasticsearch cluster performance, ILM and ingest pipelines.
• Provide consultancy to internal stakeholders.
• Escalate to resolve complex issues with other infra teams.

Tools

Git/Jenkins/Jira

Job description

Bounteous is a premier end-to-end digital transformation consultancy dedicated to partnering with ambitious brands to create digital solutions for today’s complex challenges and tomorrow’s opportunities. With uncompromising standards for technical and domain expertise, we deliver innovative and strategic solutions in Strategy, Analytics, Digital Engineering, Cloud, Data & AI, Experience Design, and Marketing.

Our Co-Innovation methodology is a unique engagement model designed to align interests and accelerate value creation. Our clients worldwide benefit from the skills and expertise of over 4,000+ expert team members across the Americas, APAC, and EMEA. By partnering with leading technology providers, we craft transformative digital experiences that enhance customer engagement and drive business success.

Location: Glasgow

Overview:

Our globally distributed squad is responsible for delivering security analytics platforms for the firm's cyber teams. We are leading the migration of our cyber data lake from Splunk to Elasticsearch (CyberELK), targeted for completion by the end of 2027. Our key stakeholders are cyber teams including security response, investigations and insider threat.

We are seeking a Cyber Data Engineer to help build and maintain CyberELK, our Elasticsearch-based platform. This is a challenging role with a steep learning curve which, with the help of a friendly and supportive squad, will transform your technical skills.

Role Profile:

A successful applicant will contribute to several important initiatives including:

• Onboarding data sources into CyberELK with appropriate field extractions and Elastic Common Schema (ECS) mapping
• Developing automation tools that integrate with in-house developed configuration management frameworks and APIs, including our AI-assisted onboarding tooling
• Tuning and optimising Elasticsearch cluster performance, including sharding, index lifecycle management (ILM) and ingest pipelines
• Providing consultancy to internal clients and stakeholders
• Working as a top-level escalation point to perform complex troubleshooting, working with other infrastructure teams to resolve issues

Required Skills:

• Prior experience deploying and managing large-scale Elasticsearch platforms in production; Splunk experience is valuable given our ongoing migration
• Experience with Elastic Stack ingest and pipeline tooling (e.g. Logstash, Beats or equivalent)
• Experience with data pipelines on a major Cloud Service Provider like GCP, Azure or AWS
• Infrastructure automation and integration experience, ideally using Python and Ansible
• A solid understanding of Operating Systems and Networking concepts: Linux/Unix system administration, HTTP and encryption.
• Good understanding of software version control, deployment & build tools using DevOps SDLC practices (Git, Jenkins, Jira)
• Strong analytical and troubleshooting skills
• Appreciation of Agile methodologies, specifically Kanban

Desired Skills:

• Elastic Certified Engineer or equivalent Elasticsearch/Elastic Stack certification; Splunk certification is a plus given our ongoing migration
• Data engineering and configuration experience including writing and testing field extractions/parsers using regular expressions
• Familiarity with cybersecurity concepts, event types, and monitoring requirements.
• Interest in using AI-assisted engineering tools (e.g. GitHub Copilot, Claude Code) to accelerate delivery.

_

Bounteous is proud to be an equal opportunity employer. Bounteous does not discriminate on the basis of race, religion, color, sex, gender identity, sexual orientation, age, physical or mental disability, national origin, veteran status, or any other status protected under federal, state, or local law. Bounteous is willing to sponsor eligible candidates for employment visas.