Forward Deployed Data Engineer(SIEM/SOAR)

Right Fit Advisors; Kansas City (MO); On-site; USD 120,000 - 180,000; Full time

Benefits offered by this job

Competitive compensation

AI-driven security tech exposure

Greenfield security project

Job summary

Right Fit Advisors invites a Forward Deployed Data Engineer - SIEM/SOAR to power MDR delivery. You will craft detection rules, parsers, SOAR playbooks, dashboards, and API integrations, enabling intelligent security operations.

You will train customers on detection content and platform capabilities, work with Deployment Engineers for go-lives, and document tuning notes to sustain scalable security outcomes.

Qualifications

• 3+ years in detection engineering, content engineering, or security operations.
• Proficiency in SIEM rule development (YARA-L, KQL) and SOAR playbooks.
• Experience with Python, Cloud Run functions, REST APIs, and dashboards.

Responsibilities

• Author, tune, and maintain detection content across Google SecOps and MS Sentinel.
• Build log parsers for new data sources and maintain SOAR playbooks.
• Develop dashboards and API integrations for common alert types and use cases.
• Collaborate with Deployment Engineers for new go-lives and coverage gaps.
• Train customers on detection content, dashboards, and platform capabilities.
• Document content with metadata, use cases, and tuning notes.
• Support AI-assisted content workflows with human review as the gate.

Skills

Detection engineering

SOAR automation

Python development

REST API integration

Dashboards development

Threat intelligence

Education

Bachelor's degree in CS or related

Tools

YARA-L

KQL

Cloud Run

Job description

Our client is looking for a Forward Deployed Data Engineer - SIEM/SOAR to build the content that powers their MDR delivery. From detection rules and log parsers to SOAR playbooks, dashboards, and custom API integrations, your work will make the platform intelligent. You will also serve as a technical trainer, helping customers understand the content they are running and the platform they are operating.

Job Responsibilities

• Author, tune, and maintain detection rules, correlation logic, and threat content across Google SecOps and Microsoft Sentinel
• Build and validate log parsers for new data sources integrated into customer environments
• Develop and maintain SOAR playbooks, automation workflows, and dashboards for common alert types and operational use cases
• Build Cloud Run functions, scripts, and API integrations where native connectors or content do not exist
• Collaborate with Deployment Engineers to ensure content is ready for new customer go-lives
• Monitor detection coverage gaps and proactively develop content to address them
• Incorporate threat intelligence and adversary TTPs (MITRE ATT&CK) into detection logic
• Serve as an advanced enablement resource for customers, training them on detection content, dashboards, and platform capabilities at a deeper technical level
• Document all content with clear metadata, use cases, and tuning notes
• Support AI-assisted content generation workflows with human review as the quality gate

Required Skills & Qualifications

Technical & Industry Expertise

• 3+ years of experience in detection engineering, content engineering, or security operations
• Strong proficiency in SIEM detection rule development - YARA-L for Google SecOps, KQL for Sentinel, or similar
• Experience building and maintaining SOAR playbooks and automation workflows
• Proficiency with log parser development for diverse data source types
• Knowledge of the MITRE ATT&CK framework and its application to detection content
• Experience with Python, Cloud Run functions, and REST API integrations
• Experience building security dashboards for operational use cases
• Understanding of threat intelligence and how TTPs translate into actionable detection logic

Soft Skills

• Strong problem-solving and troubleshooting skills with a bias toward action
• Excellent customer-facing communication and collaboration abilities
• Ability to thrive in a fast-paced, high-performance startup environment
• Passion for cybersecurity, automation, and continuous improvement

Education & Certifications

• Bachelor's degree in Computer Science, Cybersecurity, Engineering, or a related field, or equivalent practical experience
• Relevant certifications such as CISSP, CISM, GIAC certifications, Google Cloud Professional, Microsoft SC-200/AZ-500, or AWS Certified Solutions Architect are a plus

Why Join Our Client?

• Opportunity to work with cutting-edge AI-driven cybersecurity technologies and next-generation security platforms
• Collaborate with a talented and innovative team focused on continuously improving security operations
• Competitive salary and benefits package
• A culture of growth and development, with opportunities to expand your expertise in AI, cybersecurity, and engineering
• Be part of building something new - our client's Forward Deployed Engineering organization is a greenfield opportunity to define how enterprise security is delivered at scale