SIEM Data Engineer: Telemetry Pipelines & Validation

State Street

Quincy (MA)

Hybrid

USD 90,000 - 158,000

Full time

2 days ago

Be an early applicant

Get more replies from employers

Send a job-specific resume in minutes.

Job summary

State Street is seeking a SIEM Data Engineer to join its Cyber Data & Analytics function in the Boston area. The role focuses on onboarding, transforming, routing, validating, and operationally supporting cybersecurity telemetry for security monitoring and analytics.

You will build telemetry pipelines, validate data quality, and ensure reliable delivery into cyber data platforms such as Splunk and Databricks, collaborating with multiple engineering teams to enable secure, data-driven decision

Qualifications

5+ years of experience in SIEM engineering, security data engineering, cybersecurity platform operations, or log analytics.
2+ years of experience with Cribl Stream or similar data pipeline technologies (e.g., Fluent Bit/Fluentd, Vector, Kafka, Syslog, HEC, REST APIs).
2+ years of experience with Databricks, data lakehouse platforms, or security data repositories.
Experience onboarding, validating, and troubleshooting security telemetry from diverse enterprise sources.
Experience querying and validating data using SPL, SQL, Spark SQL, Python, or similar languages.
Strong collaboration with cybersecurity, infrastructure, cloud, application, and data engineering teams.

Responsibilities

Support onboarding of security telemetry from applications, infrastructure, endpoints, identity platforms, networks, cloud services, SaaS tools, databases, and security products.
Analyze source log formats and define ingestion requirements, fields, metadata, routing needs, and downstream SIEM/analytics use cases.
Configure telemetry pipelines for parsing, filtering, masking, enrichment, normalization, event breaking, metadata tagging, and destination routing.
Route security telemetry to Splunk, Databricks, and other SIEM or cyber analytics platforms.
Validate data quality in Splunk and Databricks for freshness, completeness, timestamp accuracy, field availability, schema consistency, source attribution, and routing accuracy.
Troubleshoot ingestion and data flow issues across sources, collectors, pipelines, SIEM platforms, Databricks tables, APIs, cloud storage, and streaming platforms.
Document onboarding patterns, field mappings, transformation logic, routing decisions, data flow diagrams, runbooks, troubleshooting procedures, and operational handoffs.
Participate in production support, change management, incident response, root cause analysis, and continuous improvement activities