Senior Security Data Pipeline & Observability Lead

IllTip; United States; Remote; USD 150,000 - 190,000; Full time

Benefits offered by this job

Remote work within US

Job summary

IllTip remotely supports a Mid-Atlantic practice, with the role itself authorized for work anywhere in the United States. You will design and run security telemetry pipelines that cut SIEM ingest costs, maintain data consistency, and migrate clients between platforms without sacrificing quality.

You will explain cost and risk trade-offs to both technical teams and executives, collaborating with detection, automation, and vendor partner engineering teams. Travel up to 15% may be required.

Qualifications

• 5+ years in cybersecurity, IT operations, or data engineering, including 3+ years running production telemetry pipelines.
• Hands-on production experience with Cribl Stream or a comparable pipeline platform.
• Working knowledge of at least one SIEM or analytics destination such as Splunk, Elastic, Microsoft Sentinel, Google SecOps, CrowdStrike, or SentinelOne.
• Linux administration and networking fundamentals (syslog over TCP/UDP/TLS, load balancing, firewalls) and experience with logging services in AWS, Azure, or GCP.
• Scripting and data skills in Python, JavaScript, or Bash; regular expressions; REST APIs; and JSON, CSV, XML, and key-value formats.
• Ability to brief senior leadership in writing and in person, tying technical work to measurable business goals.
• Must be based in the United States. Cribl Certified User and Certified Admin (Stream) required at hire or within 90 days.

Responsibilities

• Design, deploy, and tune telemetry pipelines using Cribl Stream, Edge, Lake, and Search, or comparable tools such as OpenTelemetry Collector, Splunk Edge Processor, or Datadog Observability Pipelines.
• Onboard and normalize logs from syslog, agents, cloud providers, SaaS APIs, identity platforms, EDR, and network devices into common schemas such as OCSF, Splunk CIM, Elastic ECS, or Google UDM.
• Build filtering, enrichment, and tiering strategies that send high-value data to premium analytics platforms and keep full-fidelity copies in low-cost storage with replay.
• Model baseline ingest and savings, then present before-and-after results to technical and financial stakeholders.
• Lead the data workstream for SIEM and platform migrations, and deliver pipeline health checks with prioritized roadmaps.
• Serve as technical point of contact on client engagements, producing as-built documentation, runbooks, and knowledge transfer.

Skills

Cribl Stream

Telemetry pipelines

Log onboarding

Python scripting

Leadership & communication

Tools

Splunk

Elastic

Microsoft Sentinel

Google SecOps

CrowdStrike

SentinelOne

Job description

IllTip remotely supports a Mid-Atlantic practice, with the role itself authorized for work anywhere in the United States. You will design and run security telemetry pipelines that cut SIEM ingest costs, maintain data consistency, and migrate clients between platforms without sacrificing quality.

You will explain cost and risk trade-offs to both technical teams and executives, collaborating with detection, automation, and vendor partner engineering teams. Travel up to 15% may be required.