Splunk / Cribl Engineer - Cybersecurity Engineering (Hybrid)

AbbVie; North Chicago (IL); On-site; USD 115,000 - 170,000; Full time

Job summary

AbbVie is seeking a Data Engineer within the Cyber Security Engineering team to expand data capabilities. You will design robust streaming and batch pipelines, normalize data for SIEM ingestion, and build scalable data models for secure storage.

The role emphasizes data integrity, end-to-end lineage, and integrations across telemetry sources, SIEM, and data warehouses, with a strong focus on security analytics and hunting.

Qualifications

• Bachelor's or Master’s degree with relevant experience in data engineering or security analytics
• Proficient in SPL for search optimization and data extraction
• Proven ability to administer Splunk Enterprise and onboard data sources
• Experience building data models, dictionaries, and reports within a SIEM
• Experience designing and configuring data pipelines
• Proficiency with regular expressions and parsing unstructured data
• Strong understanding of data governance and standardization policies
• Knowledge of database management systems and query languages

Responsibilities

• Design, implement, and enhance streaming and batch data pipelines feeding SIEM and downstream analytics.
• Normalize and harmonize data from unstructured logs before SIEM ingestion.
• Build scalable data models and optimized storage in data warehousing environments.
• Ensure data integrity and end-to-end data lineage across systems.
• Develop integrations to connect security telemetry to SIEM and data warehouses.
• Document data flows, configurations, and integration protocols with QA.
• Support analytics environments for security analytics and hunting.
• Plan capacity changes for streaming, routing, indexing, and storage infrastructure.
• Help enforce data ingestion standards and retention policies across platforms.
• Extract insights from diverse data sources to improve data quality and provide recommendations.
• Develop automation for metrics aggregation and dissemination from SIEM and data stores

Skills

SPL

Splunk Enterprise

Data pipelines

Data models

Regex

Data governance

Database concepts

Education

Bachelor's Degree (5+ years)

Master's Degree (4+ years)

Tools

Splunk

Job description

About AbbVie

AbbVie's mission is to discover and deliver innovative medicines and solutions that solve serious health issues today and address the medical challenges of tomorrow. We strive to have a remarkable impact on people's lives across several key therapeutic areas including immunology, oncology, and neuroscience - and products and services in our Allergan Aesthetics portfolio. For more information about AbbVie, please visit us at www.abbvie.com. Follow @abbvie on LinkedIn, Facebook, Instagram, X and YouTube.

Company Description

About AbbVie

AbbVie's mission is to discover and deliver innovative medicines and solutions that solve serious health issues today and address the medical challenges of tomorrow. We strive to have a remarkable impact on people's lives across several key therapeutic areas including immunology, oncology, and neuroscience - and products and services in our Allergan Aesthetics portfolio. For more information about AbbVie, please visit us at www.abbvie.com. Follow @abbvie on LinkedIn, Facebook, Instagram, X and YouTube.

Job Description

As a member of the Cyber Security Engineering (CSE) team within Information Security & Risk Management (ISRM), the Data Engineer focuses on expanding data capabilities. This role is responsible for delivering high-value data management solutions, including data pipelines, models, and SIEM platform optimization, to empower analysts and protect the business.

Responsibilities

• Data Pipeline Development: Design, implement, and enhance robust streaming and batch data pipelines utilizing message brokers to efficiently feed the SIEM and other downstream analytics engines.
• Data Transformation & Normalization: Leverage observability pipelines to aggressively route, filter, and normalize/harmonize data, creating structured datasets from unstructured logs prior to SIEM ingestion.
• Data Modeling & Architecture: Build scalable data models and enhance standard schemas within data warehousing solutions to deliver reliable, cost-effective, query-optimized storage.
• Data Integrity & Lineage: Verify data integrity and translations across distributed systems and message topics while managing end-to-end data lineage.
• Development & Integration: Analyze requirements to determine the necessary coding, API integrations, and programming activities to connect disparate security telemetry sources into the SIEM, data warehouses, or other repositories.
• Testing & Quality Assurance: Execute testing plans, debug pipeline routing issues, and thoroughly document data flows, routing configurations, and integration protocols.
• Data Management Operations: Perform the compilation, cataloging, caching, and rapid retrieval of telemetry within the SIEM and associated data lakes.
• Analytics Toolsets: Create, manage, and support advanced analytics and reporting environments operating outside the primary SIEM for long-term security analytics and hunting.
• Requirements & Capacity Planning: Define precise data specifications and proactively plan for capacity changes across streaming, routing, indexing, and storage infrastructure.
• Governance & Standards: Assist in developing, documenting, and enforcing comprehensive data ingestion standards, parsing policies, and retention procedures across all supported platforms.
• Actionable Insights: Analyze diverse data sources across the data stack to uncover trends, improve data quality, and provide actionable recommendations to the security operations team.
• Metrics Automation: Develop standards and implement robust automations for metrics aggregation and dissemination, pulling key telemetry from the SIEM and data warehouses.

Qualifications

Required

• Bachelor's Degree with 5 years' experience; or Master's Degree with 4 years' experience
• Experienced in writing and optimizing Splunk’s Search Processing Language (SPL)
• Proven ability to administer Splunk Enterprise and onboard data sources
• Skills in developing data models, dictionaries, and reports within a SIEM platform
• Experience building and configuring data pipelines
• Experience with regular expressions and parsing unstructured data
• Deep understanding of data administration and data standardization policies
• Knowledge of database management systems, query languages, table relationships, and views
• Experience in validating data sets and calculations