Senior Data and Security Engineer

Made Tech Limited; Manchester; On-site; GBP 70,000 - 110,000; Full time

Benefits offered by this job

30 days Holiday

Remote Working

Pension - employer matched

Flexible working hours

Job summary

Made Tech Limited seeks a Senior Security and Data Engineer to join our Cyber Practice in Manchester. You will bridge security engineering with operational compliance, delivering in a SOC and shaping high-volume streaming data pipelines using Cribl, Splunk, and AWS services.

You will collaborate with UK Government Civil Servants, optimise log ingestion, build robust data models, and ensure secure, least‑privilege access controls while driving detection quality and automation.

Qualifications

• Experience designing and securing cloud infrastructures in AWS (and ideally Azure/GCP).
• Experience in Splunk detection rule development and tuning.
• Hands-on with Cribl, Kinesis, S3, SQS; knowledge of OCSF schemas.

Responsibilities

• Design, implement and tune security engineering within a SOC environment.
• Develop and maintain detection rules and validation cycles to ensure high-fidelity alerts.
• Optimise streaming data pipelines and ensure secure, encrypted ingestion and storage.
• Collaborate with UK Government Civil Servants and public sector stakeholders to meet assurance requirements.

Skills

Cloud platforms

SIEM & detection

Security controls

Communication

Tools

Cribl

Kinesis

S3

SQS

Splunk

OCSF

Job description

Job description

Made Tech is seeking a Senior Security and Data Engineer to join our Cyber Practice. This is a technical delivery position, designed for an individual who excels at the intersection of security engineering, data management, and operational compliance. You will play a vital role in ensuring that the services millions of people rely on are secure, resilient, and built to rigorous standards. The core mission of this role is to bridge technical execution with operational compliance while working effectively alongside UK Government Civil Servants. You will be responsible for delivering security engineering within a Security Operations Centre (SOC) environment, translating complex technical requirements into actionable data flows to support detections and alerts. The position maintains a dual focus: hands‑on security engineering, including SIEM and detection logic development, and streaming data engineering; specifically, the optimisation and manipulation of high-volume streaming data pipelines. You will support outcomes so that high-quality security engineering is an enabler of delivery rather than a bureaucratic hurdle.

Key responsibilities

Data Engineering & Ingestion

• Pipeline Optimisation & Enrichment: Manage log ingestion pipelines on a Cribl cloud platform. You will intelligently help route, collate, filter, and normalise logs, ensuring data is tagged as soon as possible and enriched at the edge.
• AWS Cloud Telemetry Integrity: Support the end-to-end flow of AWS security telemetry (CloudTrail management and data events, VPC Flow Logs, GuardDuty findings, EKS/container audit logs, and IAM activity) into the centralised log architecture.
• Stream Processing & Pipeline Optimisation (Cribl Stream): Leverage stream processing (ideally Cribl) to parse, route, mask sensitive fields, and filter out high-volume, low-value debug noise before indexing into Splunk to maximise detection visibility.
• Data Normalisation: Build and maintain efficient Splunk data models, accelerated searches, and field extractions mapped to OCSF, ensuring fast query performance and portable detection logic.
• Troubleshooting Pipeline Bottlenecks: Diagnose and resolve systemic transport failure modes: SQS/S3 ingestion lag, universal forwarder dropouts, unparsed JSON structures, Cribl pipeline backpressure, and source type schema mismatches.
• Advanced Log Management: Optimise log sources by summarising NetFlow data, trimming bulk data to remove unnecessary payloads, deduplicating identical logs, and pre-parsing complex regex strings.
• Storage Architecture: Manage real-time streaming technologies (e.g., Kinesis) and security data storage solutions including S3 buckets and Amazon Security Lake.
• Data Tiering: Support the classification of data into appropriate storage tiers‑Hot (security events), Warm (application and performance), and Cold (compliance)‑to reduce volume overhead and optimise costs.
• Secure Ingestion: Verify that all data in transit and at rest is fully encrypted (KMS & TLS). Ensure all fields are normalised into standard schemas (OCSF) while enforcing least‑privilege access controls.

Security Engineering & Detection

• SIEM & EDR Logic Development: Support analysts in the creation and tuning of detection rules across platforms.
• Detection Quality Assurance: Act as an enabler to establish and maintain regular monitoring cycles for detection rules, helping calculate Signal-to-Noise Ratios and rule trust scores to ensure high‑fidelity alerting.

Required Technical Skills & Experience

Technical Core

• Cloud Platforms: Proven hands‑on experience designing and securing cloud infrastructures within AWS, and ideally with Azure and Google Cloud Platform.
• SIEM & Detection: Experience in supporting analysts in the creation of Splunk (SPL) detection rules.
• Data Tools & Protocols: Hands‑on experience with Cribl, Kinesis, S3 buckets, and SQS Queues. Understanding of OCSF schemas and data normalisation.
• Security Controls: Deep understanding of Zero Trust, identity‑first security, secrets management (KMS), and network segmentation.

Government Context

• Public Sector Experience: Prior experience working with or alongside UK Government Civil Servants.
• Assurance Requirements: A good understanding of public sector security assurance requirements and the ability to operate within these regulatory environments.

Skills, knowledge and expertise

• Excellent Communication Skills: You will have excellent verbal and written skills, and you will appreciate the need for good engineering discipline.
• Proportionate Judgement: You approach every engagement on its own terms, selecting and adapting frameworks and methodologies to fit the actual risk and context. You avoid "one‑size‑fits‑all" approaches in favour of what is appropriate for the scale and complexity of the project.
• Credibility with Clients: You build trusted relationships with senior stakeholders by engaging directly with their concerns.
• Delivery Focus: You maintain momentum by taking ownership of outcomes. You view security engineering as a critical component that enables good delivery rather than a process that slows it down.

What We Offer

Working at Made Tech means doing work that matters. Our public sector clients are building and running services that millions of people rely on, and the security engineering work you do directly impacts whether those services can be trusted. You'll work in multidisciplinary teams alongside delivery managers, analysts and architects, with the ability to shape how security gets done. We invest in our people through structured development, an active internal community of practice and support to engage externally. Whether that's contributing to cross-government security forums, speaking at events, or developing expertise in emerging areas of the UK government security landscape.

• Impactful Work: The opportunity to work on high‑impact public sector services that millions of people rely on daily.
• Multidisciplinary Environment: Work within diverse teams alongside delivery managers, engineers, and architects.
• Structured Development: Investment in your growth through internal communities of practice and structured career development.
• External Engagement: Support for thought leadership, including contributing to cross-government security forums, speaking at events, and developing expertise in the emerging UK government security landscape.

Job benefits

Life at Made Tech

We're committed to building a happy, inclusive and diverse workforce. You can get a sense of what it's like working here from our blog, where we talk about mental health, communities of practice and neurodiversity (as well as our client work and best practice).

Like many organisations, we use Slack to foster a sense of community and connection. As well as special interest groups such as music, food and pets, we also have 10+ Slack channels dedicated to specific communities, allies, and identities as well as dedicated learning spaces called communities of practice (COPs). If you'd like to speak to someone from one of these groups about their experience as an employee, please do let a member of the Made Tech talent team know.

Benefits

We are always listening to our growing teams and evolving the benefits available to our people. As we scale, as do our benefits and we are scaling quickly. We've recently introduced a flexible benefit platform which includes a Smart Tech scheme, Cycle to work scheme, and an individual benefits allowance which you can invest in a Health care cash plan or Pension plan. We're also big on connection and have an optional social and wellbeing calendar of events for all employees to join should they choose to.

• 30 days Holiday - we offer 30 days of paid annual leave
• Flexible Parental Leave - we offer flexible parental leave options
• Remote Working - we offer part time remote working for all our staff
• Paid counselling - we offer paid counselling as well as financial and legal advice.
• Pension - 7% employer matched

An increasing number of our customers are specifying a minimum of SC (security check) clearance in order to work on their projects. As a result, we're looking for all successful candidates for this role to have eligibility. Eligibility for SC requires 5 years' UK residency and 5 year' employment history (or back to full‑time education). Ideally, no more than 30 consecutive days spent outside the UK within the last five years. Please note that if at any point during the interview process it is apparent that you may not be eligible for SC, we won't be able to progress your application and we will contact you to let you know why.

Working hours: Our standard hours are Monday to Friday, but the nature of this role means some work outside normal hours may be required, for example during release and change windows, planned maintenance, or to align with client operating hours. This is occasional rather than routine, and we'll always give as much notice as we can and agree it with you in advance wherever possible.