Senior Security Engineer – Data Pipeline & Observability - Mid-Atlantic region (Remote)

Linuxconfig; United States; Remote; USD 140,000 - 170,000; Full time

Benefits offered by this job

Remote workforce

Health Insurance

Dental Insurance

Paid holidays

Internet allowance

Job summary

GuidePoint Security is seeking a Senior Security Engineer focused on data pipelines and observability. You will design, deploy, and optimize telemetry pipelines using Cribl Stream and related platforms, ingesting data from diverse sources into common schemas.

You will translate technical results into business terms for executives, lead SIEM migrations, enforce data governance, and collaborate with vendor partners across on-premises, cloud, and hybrid environments.

Qualifications

• 5+ years in cybersecurity, IT operations, or data engineering.
• Hands-on production experience with Cribl Stream or a comparable pipeline platform.
• Experience with at least one SIEM or analytics destination (Splunk, Elastic, Microsoft Sentinel, Google SecOps, CrowdStrike, or SentinelOne).

Responsibilities

• Architect, deploy, and optimize telemetry pipelines with Cribl Stream and comparable platforms.
• Onboard, parse, and normalize data from diverse sources into common schemas (OCSF, Splunk CIM, Elastic ECS).
• Build data reduction, filtering, and enrichment strategies to send high-value data to analytics platforms.
• Quantify business cases of baseline ingest and savings; present to technical and financial stakeholders.
• Lead data workstreams of SIEM migrations and governance across environments.

Skills

Cribl Stream

Telemetry pipelines

SIEM platforms

Executive communication

Technical writing

Tools

Cribl Stream (Edge/Lake/Search)

Splunk

Elastic

Microsoft Sentinel

Datadog Observability

Job description

Senior Security Engineer – Data Pipeline & Observability - Mid-Atlantic region (Remote)

Remote

GuidePoint Security provides trusted cybersecurity expertise, solutions and services that help organizations make better decisions and minimize risk. By taking a three-tiered, holistic approach for evaluating security posture and ecosystems, GuidePoint enables some of the nation’s top organizations, such as Fortune 500 companies and U.S. government agencies, to identify threats, optimize resources and integrate best-fit solutions that mitigate risk.

General Description

GuidePoint is both a Value-Added Reseller (VAR) and a professional services organization, and an award winning Cribl partner (Cribl Americas Solution Provider Partner of the Year, 2026). In this role you will work directly with our vendor partners and account teams, see the same problems across many client environments, and keep up with a market that is changing quickly.

Security data is growing faster than security budgets. Clients come to us because their SIEM bill is out of control, their data is inconsistent, or they are moving platforms and need the data to arrive clean. You will design and build the pipelines that fix those problems, and you will explain the cost and security trade-offs to the people who pay for them

About our Mid-Atlantic SecOps practice

Our team of data engineers, SecOps engineers, consultants, architects, and platform specialists focuses on data integration, normalization, quality, routing, retention, and platform optimization. We partner with clients, account executives, project managers, source-system owners, security teams, and technology providers to create supportable data services.

Key areas of focus include:

• Establishing reliable and reusable data pipelines.
• Improving data quality, accessibility, and processing efficiency.
• Supporting security, observability, analytics, and operational use cases.

Roles and Responsibilities:

• Architect, deploy, and optimize telemetry pipelines with Cribl Stream, Edge, Lake, and Search, and with comparable platforms such as SentinelOne AI Data Pipelines (Observo AI), CrowdStrike Onum, Palo Alto Networks Chronosphere, Datadog Observability Pipelines (Vector), Splunk Edge Processor, and the OpenTelemetry Collector
• Onboard, parse, and normalize data from syslog, agents, cloud provider logs, SaaS APIs, identity (Microsoft Entra ID, Okta), EDR, and network sources into common schemas (OCSF, Splunk CIM, Elastic ECS, Google UDM)
• Build reduction, filtering, enrichment, and tiering strategies that send only high value data to premium analytics platforms, keep full fidelity copies in low cost storage, and support replay on demand
• Quantify the business cases of baseline ingest, model savings, and present before and after results to technical and financial stakeholders
• Brief client senior leadership (CISO, CIO, CFO) on findings, progress, and recommendations, framed around the customer’s measured business goals (cost avoided, coverage gained, risk reduced, time to investigate) rather than the technical components alone
• Size and harden deployments, including worker topology, high availability and disaster recovery, queuing and backpressure, and fleet health monitoring, across on-premises, cloud, hybrid, and regulated environments
• Build governance into the data flow with masking and redaction of sensitive data, role-based access control, TLS/PKI, and retention policy
• Lead the data workstream of SIEM and platform migrations (for example Splunk, Elastic, Microsoft Sentinel, Google SecOps, CrowdStrike Falcon Next-Gen SIEM, SentinelOne AI SIEM)
• Deliver pipeline health checks and optimization assessments with prioritized, actionable roadmaps
• Support pre-sales by joining scoping calls with Solutions Architects and account teams, estimate level of effort, and contribute to statements of work
• Work with vendor partner engineering teams on joint delivery, escalations, and product feedback and maintain current partner certifications
• Work alongside Detection & Response and Automation & AI engineers to establish clean and well routed data to help make detection content, automation, and AI SOC agents more effective for our customers.
• Serve as the technical point of contact on engagements, with clear progress reporting, as-built documentation, runbooks, and knowledge transfer to client teams
• Contribute to practice intellectual property, including reusable packs, delivery playbooks, and effort baselines, and mentor other engineers

Required Experience and Education:

• 5+ years in cybersecurity, IT operations, or data engineering, including 3+ years building and running production telemetry pipelines
• Hands-on production experience with Cribl Stream or a comparable pipeline platform
• Working knowledge of at least one SIEM or analytics destination (Splunk, Elastic, Microsoft Sentinel, Google SecOps, CrowdStrike, or SentinelOne), enough to know what the data must look like when it arrives
• Client-facing delivery experience as a consultant with a services firm, VAR, systems integrator, MSSP, or vendor professional services team, or an equivalent internal role delivering to multiple business units
• Linux administration and networking fundamentals (syslog over TCP/UDP/TLS, load balancing, firewalls), plus logging services in at least one cloud (AWS, Azure, or GCP)
• Ability to engage senior leadership and translate technical work into business terms, tying recommendations to the customer’s measurable goals rather than to the technical components alone, in writing and in person
• Cribl Certified User and Cribl Certified Admin (Stream), held at hire or earned within 90 days
• Embraces emerging technologies, including AI tools, to work smarter, solve problems, and drive better business outcomes.

Preferred Experience and Education

• Experience at a VAR, systems integrator, or MSSP working within vendor partner programs (partner certifications, joint delivery, supporting account teams on deals)
• Technical writing experience: assessment reports, executive summaries, architecture and as-built documents, and roadmaps written for both technical and executive readers (writing samples welcome)
• Delivery experience on more than one pipeline platform, with the judgment to recommend the right tool for the client
• Cribl Certified Admin (Edge); Splunk Certified Admin or Architect; Elastic Certified Engineer; SentinelOne AI Data Pipelines; cloud certifications (AWS, Azure, GCP)
• Kubernetes and containers; Terraform or Ansible; Git and CI/CD for pipeline configuration as code
• Kafka, object storage and data lakes (Amazon S3, Azure Blob, Cribl Lake), and Snowflake or Databricks as destinations
• OpenTelemetry for metrics and traces, and IT observability use cases alongside security
• Familiarity with MITRE ATT&CK data sources and what detection engineers need from the data
• Regulated or federal environments (HIPAA, PCI DSS, FedRAMP, CMMC, FIPS); ability to obtain a U.S. security clearance is a plus

Travel Requirements:

• Up to 15% travel

Physical Requirements:

• Sedentary work
• Substantial movement of the wrists, hands, and/or fingers for a minimum of 8 hours a day
• Required to have close visual acuity to view computer terminal and/or extensive reading for a minimum of 8 hours a day

Note: Applicants must be authorized to work for any employer in the U.S. We are unable to sponsor or take over sponsorship of an employment visa for this role.

Why GuidePoint?

GuidePoint Security is a rapidly growing, profitable, privately-held value added reseller that focuses exclusively on Information Security. Since its inception in 2011, GuidePoint has grown to over 1,300 employees, established strategic partnerships with leading security vendors, and serves as a trusted advisor to more than 6,200 customers.

Firmly-defined core values drive all aspects of the business, which have been paramount to the company’s success and establishment of an enjoyable workplace atmosphere. At GuidePoint, your colleagues are knowledgeable, skilled, and experienced and will seek to collaborate and provide mentorship and guidance at every opportunity.

This is a unique and rare opportunity to grow your career along with one of the fastest growing companies in the nation.

Some added perks….

• Remote workforce primarily (U.S. based only, some travel may be required for certain positions, working on-site may be required for Federal positions)
• Group Medical Insurance options: Zero Deductible PPO Plan (GuidePoint pays 90% of the premium for employees and 70% for family plans (spouse/children/family) or High Deductible Health Plan with HSA (GuidePoint pays 100% of the employees premiums and 75% for family plans (spouse/children/family). If you choose the High Deductible / HSA plan, GPS will contribute in 4 equal quarterly installments: ($850 per EE annually / $1750 per family annually (includes spouse/children/family options)
• Group Dental Insurance: GuidePoint pays 100% of the premium for employees and 75% of family plans
• 12 corporate holidays and a Flexible Time Off (FTO) program
• Healthy mobile phone and home internet allowance
• Eligibility for retirement plan after 2 months at open enrollment

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey.Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiringprocess or thereafter. Any information that you do provide will be recorded and maintained in aconfidential file.

As set forth in GuidePoint Security’s Equal Employment Opportunity policy,we do not discriminate on the basis of any protected group status under any applicable law.

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection.As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measurethe effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categoriesis as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.