Senior Security Data Engineer � SIEM Data Pipeline

Danta Technologies; Bellevue (WA); Hybrid; USD 150,000 - 190,000; Full time

Benefits offered by this job

Healthcare insurance

Paid holidays

Paid sick leave

Job summary

Danta Technologies is seeking four Senior Security Data Engineers to lead the architecture, design, and deployment of scalable security telemetry ingestion pipelines using Cribl and Vector. You will orchestrate data flows across 100+ sources and integrate with downstream SIEM and analytics platforms.

Expertise in security data ingestion, normalization, enrichment, and Open Cybersecurity Schema Framework implementation is required, with strong scripting skills in Python, JavaScript, or Groovy.

Qualifications

• 10+ years of experience in cybersecurity.
• Hands-on experience with Cribl and Vector mandatory.
• 5+ years of experience with data ingestion and pipeline platforms.
• 5+ years of scripting with Python, JavaScript, Groovy, or similar.
• Strong understanding of SIEM platforms and security telemetry data ingestion.

Responsibilities

• Lead architecture, design, and implementation of scalable data ingestion pipelines.
• Develop platform-agnostic ingestion frameworks and templates for multiple input sources.
• Integrate data pipelines with downstream platforms (Snowflake, Splunk, ADX, Log Analytics).
• Implement OCsf strategies including field mapping and schema validation.
• Develop data transformations and enrichments using Python/JS/Groovy.
• Support filtering, enrichment, routing, and format conversions (JSON, CSV, XML, Logfmt).
• Establish secure data movement with SSL/TLS and authentication.
• Ensure end-to-end data traceability, lineage, and change tracking.
• Monitor pipelines for failures and data quality issues.
• Collaborate with cybersecurity, observability, analytics, and platform teams.
• Maintain documentation of ingestion patterns and data governance.

Skills

Cybersecurity data engineering

Cribl

Vector

Python

JavaScript

Groovy

Data ingestion

Security telemetry

Tools

Snowflake

Splunk

ADX

Log Analytics

Anvilogic

Kafka

Syslog

Event Hubs

Blob Storage

Job description

Employment Eligibility Statement

Due to specific project and client requirements, this position is open to U.S. Citizens. Sponsorship is not available at this time.

Employment Eligibility Statement

Due to specific project and client requirements, this position is open to U.S. Citizens. Sponsorship is not available at this time.
Danta Technologies evaluates all candidates in compliance with the Immigration and Nationality Act (INA) and EEOC guidelines. All hiring decisions are made without regard to race, color, religion, sex, gender identity, sexual orientation, national origin, age, disability, veteran status, or any other protected characteristic.

Location Preference:

• 1st Preference Onsite: Overland Park, KS | Bellevue, WA (4 days onsite per week).
• 2nd Preference Hybrid: Candidates open to hybrid work arrangements in either of the above locations will also be considered.
• 3rd Preference Remote: Fully remote candidates may also be considered.
• Priority: Candidates willing to work onsite at one of the specified locations will receive first preference. Hybrid and remote candidates will be considered based on their experience and client requirements.

Position Overview

We are seeking four experienced Senior Security Data Engineers to lead the architecture, design, and implementation of scalable security telemetry ingestion and transformation pipelines as part of a major SIEM Modernization initiative.
The engineers will be responsible for orchestrating complex security data flows across 100+ existing and new cybersecurity data sources. The primary technologies for this initiative are Cribl and Vector, and hands-on experience with BOTH technologies is mandatory.
Candidates should have strong cybersecurity data engineering experience, with expertise in security telemetry ingestion, data normalization, transformation, enrichment, and delivery to downstream SIEM and analytics platforms.

Key Responsibilities

• Lead the architecture, design, and implementation of scalable, modular, and reusable data ingestion pipelines using Cribl and Vector.
• Develop platform-agnostic ingestion frameworks and reusable templates supporting multiple input sources, including Syslog, Kafka, HTTP, Event Hubs, and Blob Storage.
• Integrate data pipelines with downstream platforms such as Snowflake, Splunk, ADX, Log Analytics, and Anvilogic.
• Implement Open Cybersecurity Schema Framework (OCSF) strategies, including field mapping, transformation templates, and schema validation.
• Develop custom data transformations and enrichments using Python, JavaScript, Groovy, or other scripting languages.
• Implement filtering, enrichment, dynamic routing, and format conversions such as JSON, CSV, XML, and Logfmt.
• Establish secure data movement practices, including SSL/TLS, client authentication, input validation, and logging.
• Ensure end-to-end data traceability, lineage, metadata tagging, correlation IDs, and change tracking.
• Monitor ingestion pipelines, transformation failures, and data quality issues.
• Ensure reliable data delivery with minimal data loss, duplication, or transformation inconsistencies.
• Collaborate with cybersecurity, observability, analytics, and platform engineering teams.
• Maintain technical documentation covering ingestion patterns, transformation libraries, schema definitions, and data governance standards.

Mandatory Qualifications

• 10+ years of experience in Cybersecurity.
• Hands-on production experience with BOTH Cribl AND Vector Mandatory.
• 5+ years of experience working with data ingestion and pipeline platforms.
• 5+ years of scripting experience using Python, JavaScript, Groovy, or similar languages.
• Strong understanding of SIEM platforms and security telemetry data ingestion.
• Experience designing and implementing data transformation, filtering, routing, and enrichment workflows.
• Experience working with structured and unstructured security log data.
• Must be a U.S. citizen.

Preferred Qualifications

• Experience with Open Cybersecurity Schema Framework (OCSF).
• Experience with Splunk, Snowflake, ADX, Log Analytics, or Anvilogic.
• Knowledge of Kafka, Syslog, HTTP, Event Hubs, and Blob Storage.
• Experience with security data normalization, schema mapping, and validation.
• Experience supporting SIEM modernization initiatives.

Notes

All qualified applicants will receive consideration for employment without regard to race, color, religion, religious creed, sex, national origin, ancestry, age, physical or mental disability, medical condition, genetic information, military and veteran status, marital status, pregnancy, gender, gender expression, gender identity, sexual orientation or any other characteristic protected by local law, regulation, or ordinance.

Benefits

Danta offers a compensation package to all W2 employees that are competitive in the industry. It consists of competitive pay, the option to elect healthcare insurance (Dental, Medical, Vision), Major holidays and Paid sick leave as per state law.

The rate/ Salary range is dependent on numerous factors including Qualification, Experience and Location.