SIEM Data Pipeline Engineer Cribl / Vector

Employment Eligibility Statement:
Due to specific project and client requirements, this position is open to U.S. Citizens. Sponsorship is not available at this time.
Danta Technologies evaluates all candidates in compliance with the Immigration and Nationality Act (INA) and EEOC guidelines. All hiring decisions are made without regard to race, color, religion, sex, gender identity, sexual orientation, national origin, age, disability, veteran status, or any other protected characteristic.

Job Title: Senior SIEM Data Pipeline Engineer – Cribl / Vector
Location: Bellevue, WA / Overland Park, KS / Remote (USA)
Work Arrangement: Remote within the United States is permitted. Candidates may also work onsite at the Bellevue, WA, or Overland Park, KS locations.
Pay Rate: $50/hr on W2, all-inclusive – Danta Technologies payroll
Work Authorization: U.S. Citizens Only


Important Candidate Qualification Note:
This role is specifically intended for engineers with hands-on experience in cybersecurity telemetry ingestion, SIEM data pipelines, and log transformation platforms. Candidates whose experience is limited to general ETL/data engineering, SIEM dashboard development, SOC monitoring, or incident response without relevant pipeline engineering experience may not be a fit.


Job Description:
We are seeking four experienced Senior Security Data Engineers to support a large-scale Security Information and Event Management (SIEM) modernization initiative. The ideal candidates will have extensive cybersecurity experience and strong hands-on expertise in designing, developing, and optimizing security telemetry ingestion and data transformation pipelines using Cribl, Vector, Splunk, Datadog, or comparable data pipeline platforms.

This role focuses on architecting scalable, reusable, and secure data ingestion frameworks to collect, normalize, enrich, and route security telemetry from more than 100 existing and new data sources into downstream SIEM, analytics, and data storage platforms.

The successful candidates will bring a strong combination of security data engineering, pipeline architecture, scripting, schema normalization, and enterprise-scale data integration experience.

Key Responsibilities:

• Lead the architecture, design, development, and implementation of scalable, modular, and reusable security data ingestion pipelines using Cribl, Vector, or comparable platforms.

• Build standardized ingestion frameworks and reusable templates to support diverse security telemetry sources, including syslog, Kafka, HTTP, Azure Event Hubs, Blob Storage, and legacy or non-standard log sources.

• Design and implement data routing, filtering, parsing, enrichment, transformation, and format conversion processes for structured and unstructured security logs.

• Develop and maintain schema normalization strategies using the Open Cybersecurity Schema Framework (OCSF), including field mapping, transformation templates, and schema validation.

• Create custom transformation and enrichment logic using Python, JavaScript, Groovy, or other suitable scripting languages.

• Integrate ingestion pipelines with downstream platforms, including Splunk, Snowflake, Azure Data Explorer (ADX), Azure Log Analytics, and Anvilogic.

• Implement security controls for data movement, including SSL/TLS, client authentication, input validation, and secure handling of telemetry.

• Establish end-to-end data traceability and lineage through metadata tagging, correlation IDs, change tracking, and audit-ready documentation.

• Implement pipeline health monitoring, transformation failure logging, data quality checks, and anomaly detection mechanisms in collaboration with observability and platform teams.

• Troubleshoot ingestion failures, data loss, duplication, schema inconsistencies, and transformation drift to ensure reliable data delivery.

• Develop and maintain technical documentation covering ingestion patterns, transformation libraries, naming conventions, schema definitions, governance procedures, and platform integrations.

• Collaborate with cybersecurity, threat detection, analytics, and platform engineering teams to align pipeline capabilities with security monitoring, compliance, and investigative requirements.

• Lead technical discussions and recommend appropriate tools, frameworks, and best practices for enterprise-scale security telemetry management.

Required Qualifications:

• 10+ years of experience working in cybersecurity, security engineering, or closely related technical domains.

• 5+ years of hands-on experience with Cribl, Vector, Datadog, Splunk, or comparable data ingestion, observability, or telemetry pipeline platforms.

• 5+ years of programming or scripting experience using Python, JavaScript, Groovy, or other relevant languages.

• Strong experience designing, implementing, and troubleshooting production-grade log ingestion and data transformation pipelines.

• Hands-on knowledge of SIEM architectures, security telemetry, log management, and security event processing.

• Experience working with multiple log formats and ingestion protocols, including syslog, JSON, HTTP, Kafka, XML, and other structured or unstructured formats.

• Experience implementing data parsing, filtering, enrichment, normalization, routing, and schema validation.

• Strong understanding of secure data transport, authentication, data governance, monitoring, and pipeline reliability.

• Experience integrating data ingestion pipelines with enterprise security analytics, SIEM, or data storage platforms.

• Ability to work independently on complex technical challenges and collaborate with distributed engineering and cybersecurity teams.

Preferred Qualifications:

• Experience implementing the Open Cybersecurity Schema Framework (OCSF) or comparable security event normalization standards.

• Experience integrating security telemetry with Splunk, Snowflake, Azure Data Explorer, Azure Log Analytics, or Anvilogic.

• Familiarity with Azure Event Hubs, Blob Storage, Kafka, and other event streaming or cloud data ingestion technologies.

• Experience designing platform-agnostic ingestion frameworks and reusable transformation templates.

• Knowledge of security event correlation, threat detection use cases, audit requirements, and forensic data traceability.

• Experience with enterprise observability, pipeline monitoring, and large-scale data quality management.

Work Location:

This position supports candidates working remotely from anywhere within the United States. Candidates may also choose the onsite arrangement at the client's Bellevue, Washington, or Overland Park, Kansas, location, subject to client requirements. Onsite candidates are expected to work four days per week at the designated office.

Notes:- All qualified applicants will receive consideration for employment without regard to race, color, religion, religious creed, sex, national origin, ancestry, age, physical or mental disability, medical condition, genetic information, military and veteran status, marital status, pregnancy, gender, gender expression, gender identity, sexual orientation, or any other characteristic protected by local law, regulation, or ordinance.

Benefits: Danta offers a compensation package to all W2 employees that are competitive in the industry. It consists of competitive pay, the option to elect healthcare insurance (Dental, Medical, Vision), Major holidays and Paid sick leave as per state law.

The rate/ Salary range is dependent on numerous factors including Qualification, Experience and Location.