Senior Data and Security Engineer

Made Tech Limited; West of England; On-site; GBP 55,000 - 85,000; Full time

Benefits offered by this job

Impactful Work

Multidisciplinary Environment

Structured Development

External Engagement

Job summary

Made Tech is seeking a Senior Data and Security Engineer to join the Cyber Practice. This role spans security engineering, data management, and operational compliance, bridging technical delivery with government regulatory requirements.

You will work in a SOC environment, develop SIEM rules, and optimise high‑volume data pipelines while ensuring secure, compliant data flows across Cribl, Kinesis and Splunk.

Qualifications

• Cloud platforms: AWS, Azure, GCP experience.
• Splunk (SPL) rule support experience.
• Cribl, Kinesis, S3, SQS knowledge.
• Zero Trust and secrets management (KMS) understanding.

Responsibilities

• Pipeline optimisation & enrichment of logs on Cribl cloud.
• End-to-end flow of AWS telemetry into central log architecture.
• Cribl Stream processing for parsing, routing, masking and filtering logs.
• Create and optimise Splunk data models and field extractions (OCSF).
• Diagnose and resolve ingestion bottlenecks (SQS, S3, JSON).
• Summarise NetFlow data and trim unnecessary payloads.
• Manage streaming tech (Kinesis) and storage (S3, Security Lake).
• Data tiering: Hot, Warm, Cold for cost efficiency.
• Ensure data in transit/rest is encrypted (KMS, TLS).
• Develop/detune detection rules; monitor rule quality and trust.

Skills

Communication

Delivery focus

Credibility with clients

Security mindset

Tools

Cribl

Kinesis

S3

SQS

Splunk

OCSF

KMS

AWS

Azure

GCP

Job description

Senior Data and Security Engineer

Department: Technology

Employment Type: Permanent

Location: Any UK Office Hub (Bristol / London / Manchester / Swansea)

Compensation: GBP 55,000 - GBP 85,000 / year

Description

Made Tech is seeking a Senior Security and Data Engineer to join our Cyber Practice. This is a technical delivery position, designed for an individual who excels at the intersection of security engineering, data management, and operational compliance. You will play a vital role in ensuring that the services millions of people rely on are secure, resilient, and built to rigorous standards. The core mission of this role is to bridge technical execution with operational compliance while working effectively alongside UK Government Civil Servants. You will be responsible for delivering security engineering within a Security Operations Centre (SOC) environment, translating complex technical requirements into actionable data flows to support detections and alerts. The position maintains a dual focus: hands‑on security engineering, including SIEM and detection logic development, and streaming data engineering; specifically, the optimisation and manipulation of high‑volume streaming data pipelines. You will support outcomes so that high‑quality security engineering is an enabler of delivery rather than a bureaucratic hurdle.

Key Responsibilities

Data Engineering & Ingestion

• Pipeline Optimisation & Enrichment: Manage log ingestion pipelines on a Cribl cloud platform. You will intelligently help route, collate, filter, and normalise logs, ensuring data is tagged as soon as possible and enriched at the edge.
• AWS Cloud Telemetry Integrity: Support the end‑to‑end flow of AWS security telemetry (CloudTrail management and data events, VPC Flow Logs, GuardDuty findings, EKS/container audit logs, and IAM activity) into the centralised log architecture.
• Stream Processing & Pipeline Optimisation (Cribl Stream): Leverage stream processing (ideally Cribl) to parse, route, mask sensitive fields, and filter out high‑volume, low‑value debug noise before indexing into Splunk to maximise detection visibility.
• Data Normalisation: Build and maintain efficient Splunk data models, accelerated searches, and field extractions mapped to OCSF, ensuring fast query performance and portable detection logic.
• Troubleshooting Pipeline Bottlenecks: Diagnose and resolve systemic transport failure modes: SQS/S3 ingestion lag, universal forwarder dropouts, unparsed JSON structures, Cribl pipeline backpressure, and source type schema mismatches.
• Advanced Log Management: Optimise log sources by summarising NetFlow data, trimming bulk data to remove unnecessary payloads, deduplicating identical logs, and pre-parsing complex regex strings.
• Storage Architecture: Manage real‑time streaming technologies (e.g., Kinesis) and security data storage solutions including S3 buckets and Amazon Security Lake.
• Data Tiering: Support the classification of data into appropriate storage tiers-Hot (security events), Warm (application and performance), and Cold (compliance)-to reduce volume overhead and optimise costs.
• Secure Ingestion: Verify that all data in transit and at rest is fully encrypted (KMS & TLS). Ensure all fields are normalised into standard schemas (OCSF) while enforcing least‑privilege access controls.

• SIEM & EDR Logic Development: Support analysts in the creation and tuning of detection rules across platforms.
• Detection Quality Assurance: Act as an enabler to establish and maintain regular monitoring cycles for detection rules, helping calculate Signal-to-Noise Ratios and rule trust scores to ensure high‑fidelity alerting.

Required Technical Skills & Experience

Technical Core

• Cloud Platforms: Proven hands‑on experience designing and securing cloud infrastructures within AWS, and ideally with Azure and Google Cloud Platform.
• SIEM & Detection: Experience in supporting analysts in the creation of Splunk (SPL) detection rules.
• Data Tools & Protocols: Hands‑on experience with Cribl, Kinesis, S3 buckets, and SQS Queues. Understanding of OCSF schemas and data normalisation.
• Security Controls: Deep understanding of Zero Trust, identity‑first security, secrets management (KMS), and network segmentation.

Government Context

• Public Sector Experience: Prior experience working with or alongside UK Government Civil Servants.
• Assurance Requirements: A good understanding of public sector security assurance requirements and the ability to operate within these regulatory environments.

Skills, Knowledge & Expertise

• Excellent Communication Skills: You will have excellent verbal and written skills, and you will appreciate the need for good engineering discipline.
• Proportionate Judgement: You approach every engagement on its own terms, selecting and adapting frameworks and methodologies to fit the actual risk and context. You avoid "one-size-fits-all" approaches in favour of what is appropriate for the scale and complexity of the project.
• Credibility with Clients: You build trusted relationships with senior stakeholders by engaging directly with their concerns.
• Delivery Focus: You maintain momentum by taking ownership of outcomes. You view security engineering as a critical component that enables good delivery rather than a process that slows it down.

What We Offer

Working at Made Tech means doing work that matters. Our public sector clients are building and running services that millions of people rely on, and the security engineering work you do directly impacts whether those services can be trusted. You'll work in multidisciplinary teams alongside delivery managers, analysts and architects, with the ability to shape how security gets done. We invest in our people through structured development, an active internal community of practice, and support to engage externally. Whether that’s contributing to cross‑government security forums, speaking at events, or developing expertise in emerging areas of the UK government security landscape.

• Impactful Work: The opportunity to work on high‑impact public sector services that millions of people rely on daily.
• Multidisciplinary Environment: Work within diverse teams alongside delivery managers, engineers, and architects.
• Structured Development: Investment in your growth through internal communities of practice and structured career development.
• External Engagement: Support for thought leadership, including contributing to cross‑government