Data Analytics Engineer

Intec Select Ltd; City Of London; Hybrid; GBP 120.000 - 138.000; Vollzeit

Zusammenfassung

Intec Select Ltd is seeking a Data Analytics Engineer to lead the migration and optimisation of log ingestion and observability pipelines, moving sources from Splunk to Cribl Stream/Edge. Hybrid role with on-site days in City of London.

You will design resilient Cribl pipelines, onboard security log sources, and work with SOC/IR teams to ensure reliable SIEM operations while reducing ingestion and storage costs.

Qualifikationen

• Strong hands-on Splunk SIEM engineering (indexers, search heads, clustering, forwarders, CIM, performance optimisation).
• 2+ years with Cribl Stream/Edge, including distributed deployments.
• Experience with log transport (syslog, HEC, TCP/UDP) in HA logging environments.
• Proven onboarding and tuning of security log sources for SOC/IR support.
• Advanced SPL, data models, event parsing and alert tuning.

Aufgaben

• Lead migration of log sources to Cribl pipelines.
• Design resilient pipelines for high ingest volumes (Cribl worker groups, external load balancers, syslog distribution).
• Onboard, parse and tune security log sources for SOC/IR support.
• Build and maintain Cribl and Splunk configs: transformations, field normalisation, masking, enrichment.
• Work with SOC, IR and threat detection teams so security logs reach the SIEM reliably.
• Monitor and resolve pipeline and SIEM issues, report on ingest reduction and cost savings.
• Document log flows, pipeline topology and operational procedures.

Kenntnisse

Splunk SIEM

Cribl Stream

Log pipelines

Python scripting

Dashboard monitoring

Troubleshooting

Jobbeschreibung

Data Analytics Engineer | Splunk & Cribl | SIEM Pipelines

We're hiring a Data Analytics Engineer to lead the migration, optimisation and secure operation of log ingestion and observability pipelines, with a focus on moving log sources from Splunk ingestion to Cribl Stream/Edge.

The role

• Lead the migration of log sources to load-balanced, fault-tolerant Cribl pipelines
• Design and run resilient pipelines for high ingest volumes (Cribl worker groups, external load balancers, syslog distribution)
• Onboard, parse and tune security log sources (firewalls, EDR, cloud, authentication, proxies), using data reduction to cut Splunk ingest and storage costs without losing security coverage
• Build and maintain Cribl and Splunk configs: transformations, field normalisation, masking, enrichment
• Work with SOC, IR and threat detection teams so security logs reach the SIEM reliably and are tuned for detection
• Monitor and resolve pipeline and SIEM issues, and report on ingest reduction, cost savings, pipeline health and event loss
• Document log flows, pipeline topology and operational procedures

What you'll bring

• Strong hands-on Splunk SIEM engineering (indexers, search heads, clustering, forwarders, CIM, performance optimisation)
• 2+ years with Cribl Stream/Edge, including distributed, load-balanced deployments
• Solid grasp of log transport (syslog, HEC, TCP, UDP) and balancing strategies in HA logging environments
• Proven experience onboarding and tuning security log sources for SOC/IR support
• Advanced SPL, data models, event parsing and alert tuning
• Scripting skills (Python, shell/CLI or similar) for pipeline management and validation
• Good troubleshooting skills and experience building monitoring dashboards

Details

• £650 - £750 P/D
• Initial 6-month contract role (strong likelihood to extend)
• Hybrid role (2-3 days P/W on-site)