Security Data Engineer - Senior

The candidate will architect, build, and maintain data pipelines ingesting network traffic, VPC flow logs, firewall/proxy logs, DNS records etc. into the organization's centralized systems. The candidate will; ensure ingested data is structured, normalized (e.g., OCSF or CIM standard), and continuously parsed correctly for immediate querying and correlation. Design, write, and deploy high-fidelity detection rules using SQL, Sigma, YARA-L, or Python targeting network-based attack techniques (e.g., C2 beaconing, data exfiltration, and lateral movement). Continuously tune network detections to reduce false-positive rates while maintaining a high signal-to-noise ratio. Identify telemetry required to support network monitoring, threat hunting, incident response, and custom detection engineering. Map detection requirements to underlying data sources and identify visibility gaps across hybrid cloud and on-premises environments Design and maintain pipelines that ingest security telemetry from network, endpoint, identity, cloud, application, OT, and security infrastructure. Ensure telemetry is delivered reliably to SIEM, data lake, analytics, and detection platforms; troubleshoot ingestion, parsing, latency, and data-quality issues. Evaluate whether packet, flow, session, DNS, proxy, authentication, endpoint, and application telemetry is sufficient for specific detection requirements. Support custom detection development through data discovery, enrichment, normalization, and validation. Identify opportunities to move detections from low-level indicators toward higher-level behavioral and tradecraft-based detection using the Detection Stack. Work with network engineering teams to evaluate technologies such as network sensors, NetFlow/IPFIX, DNS telemetry, proxy telemetry, firewall logs, IDS/IPS, packet capture, Zeek/network metadata, and NDR platforms. Establish telemetry health metrics, dashboards, and automated checks for missing, delayed, or malformed data. Assess network visibility across data centers, cloud environments, remote networks, and segmented environments. Optimize telemetry architectures and ingestion pipelines for performance, scalability, reliability, and cost Experience in; translating detection requirements into specific data and telemetry requirements. Experience with technologies such as NetFlow/IPFIX, Zeek, Wireshark, IDS/IPS, firewalls, proxies, or network detection platforms, network segmentation, routing, VLANs, VPNs, cloud networking, and encrypted traffic. Experience designing or maintaining security data ingestion pipelines. Experience working with JSON, XML, CSV, CEF, LEEF, ECS, or other security-data formats. Experience with at least one scripting language such as Python. Ability to conduct data-source and detection-gap assessments. Experience working with threat hunting or purple-team activities. Experience writing or tuning detections using SQL, Sigma, YARA-L, Python, or similar. Ability to work with network, infrastructure, and cyber operations teams to enable and validate telemetry sources. Bachelor's degree in cybersecurity, computer science, security engineering, data science, network security, or a related field and 18 years of relevant professional experience; or Master's degree in one of the same fields and 10 years of relevant professional experience Must possess a Top Secret with SCI eligibility. SAR/SAP experience is highly desirable. Place of work is Colorado Springs; remote work opportunity is limited. You may be required to travel periodically, less than 20%.