Senior Cyber Engineer - Security Logging & Data Platforms

Overview

Hands-on engineering, operation and continuous improvement of the end-to-end security logging and telemetry capability, from collection at source through transport, processing, routing and storage to SIEM and other authorised security consumers. Primarily a technical engineering role with a technical leadership component and no formal people-management accountability.

What you'll do

• Design, build, operate and troubleshoot security telemetry pipelines from source systems through collection and processing platforms to storage, SIEM and downstream consumers.
• Engineer collection patterns for cloud, SaaS, on-premises, network, endpoint and application sources using technologies such as APIs, syslog/CEF, JSON, Event Hubs, Windows Event Collection and agent-based collection.
• Own complex onboarding and integration work end to end, including requirements, design, build, testing, production deployment, validation, documentation and transition into support.
• Diagnose failures across distributed pipelines and coordinate recovery across internal teams, platform providers and technology vendors.
• Ensure pipeline designs meet security, availability, performance, scalability and supportability requirements.
• Provide hands-on engineering across Stream, Edge and Search, including routes, pipelines, functions, packs, event breaking, worker groups, fleet management, lookups and search use cases.
• Maintain platform health through monitoring, patching, upgrades, vulnerability remediation, capacity management, configuration control and performance tuning.
• Develop reusable patterns and automation that make onboarding, routing and operational support faster, safer and more consistent.
• Optimise data volumes and processing to improve efficiency and manage ingestion, storage and licensing costs without compromising agreed security outcomes.
• Support the controlled extension of Cribl capabilities to suitable data and observability use cases beyond traditional SIEM ingestion.
• Engineer and support integrations into SIEM and other approved destinations, including long-term storage and search platforms.
• Monitor source, dataset and destination health and resolve issues affecting data availability, completeness, timeliness or usability.
• Work with SOC, RADAR, detection engineering, threat hunting and incident response stakeholders to translate security use cases into clear telemetry requirements.
• Validate that onboarded data supports intended detection, investigation and hunting outcomes before declaring delivery complete.
• Apply and improve standards for parsing, normalisation, schema alignment, enrichment, filtering, metadata, routing and data validation.
• Define quality checks and acceptance criteria for new and changed sources, including completeness, field quality, timestamp handling, duplication, latency and routing accuracy.
• Create and maintain source ownership, design decisions, dependencies, support models and known limitations.
• Use customer feedback, operational evidence and platform metrics to improve the quality and value of security data products.
• Operate the logging and SIEM pipeline as a critical production capability, including health monitoring, incident response, problem management, root-cause analysis and service restoration.
• Plan and execute production changes, upgrades and releases in line with change-control requirements and with minimal disruption to dependent services.
• Develop and maintain dashboards, alerts, runbooks, troubleshooting guides, recovery procedures and support documentation.
• Contribute to resilience, continuity and recovery planning, and test that critical operational procedures work in practice.
• Participate in the standby/on-call rota and support major incidents or high-priority operational activity when required.
• Maintain operational metrics covering platform health, ingestion failures, source coverage, backlog, change success, patching, capacity, data quality, cost and risk.
• Act as a key technical contributor to the strategy, roadmap and architectural evolution of the security logging, data pipeline and SIEM capability.
• Provide engineering input into lifecycle, capacity, licensing, cost forecasting, technical debt, supportability and investment decisions.
• Evaluate new features, integration patterns and technologies through structured technical assessment and proof of value.
• Work directly with strategic vendors and service partners to resolve technical issues, improve platform outcomes and influence product direction where appropriate.
• Identify operational or architectural risks early and provide clear options, recommendations and escalation paths to leadership.
• Provide technical leadership without relying on formal line-management authority, including mentoring engineers, reviewing designs and implementations, and leading complex engineering investigations.
• Promote shared ownership by establishing primary and secondary coverage for critical platform areas and reducing reliance on individual experts.
• Create reusable documentation, patterns and learning material so that successful solutions can be repeated consistently.
• Communicate progress, risks, dependencies and outcomes clearly to technical and non-technical stakeholders.

Details

• Location: Bengaluru, India.
• Participation in the team's standby/on-call rota is required.