Data Security Engineer (Tuning)

Deloitte’s Enterprise Security team is focused on embedding protection across digital transformation, with an emphasis on securing the technical backbone while enabling secure innovation. In this role, you will build and tune security telemetry pipelines that support reliable threat monitoring, detection coverage, and lower false positives across a range of security and network data sources.

As a Security Data Engineer (Tuning), you will own end-to-end telemetry and detection logic, working backward from detection objectives to ensure the right data is collected, normalized, enriched, and validated for correlation in detection and analytics platforms. The work spans network traffic monitoring, threat hunting, custom detection engineering, and adversary detection across on-premises, cloud, remote, and segmented environments.

What you’ll do

• Own end-to-end security telemetry pipelines for network traffic monitoring, threat hunting, custom detection engineering, and adversary detection by defining data sources, collection methods, telemetry fields, retention, normalization, and data-quality controls.
• Architect, build, and maintain telemetry pipelines to identify, onboard, and ingest security data across network, endpoint, identity, cloud, application, operational technology (OT), and security-infrastructure domains, including NetFlow, PCAP, VPC flow logs, firewall and proxy logs, and DNS records.
• Map telemetry to detection and operational needs by determining what data is required for network monitoring, threat hunting, incident response, and custom detection engineering, including visibility gap assessment across different environments.
• Normalize, enrich, and validate telemetry using OCSF or CIM standards, ensuring data is suitable for correlation and troubleshooting ingestion, parsing, latency, retention, field coverage, and data-quality issues across SIEM, data lake, analytics, and detection platforms.
• Design and tune high-fidelity detection logic using SQL, Sigma, YARA-L, or Python, targeting network-based attack techniques such as command-and-control beaconing, data exfiltration, and lateral movement while reducing false positives and preserving detection signal.
• Collaborate with network engineering and stakeholders to evaluate sensors and telemetry such as NetFlow/IPFIX, DNS and proxy data, firewall logs, IDS/IPS, packet capture, Zeek or network metadata, and NDR platforms.
• Define telemetry health metrics with dashboards and automated checks for missing, delayed, or malformed data, and optimize telemetry architectures for performance, scalability, reliability, and cost.

Requirements

• Bachelor’s degree and 3+ years of experience in data engineering, data integration, security engineering, or security operations.
• Active TS/SCI or SCI eligibility is required.
• 3+ years conducting data investigations and using scripting languages for data engineering workflows.
• 3+ years using SQL and Python to transform, validate, or analyze data.
• Experience using MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) for security log design.
• Experience configuring or tuning ingestion, parsing, normalization, or enrichment for security data.
• Experience using a SIEM platform, log management platform, or security data lake.
• Ability to travel 10% on average.
• Must be legally authorized to work in the United States without employer sponsorship, now or in the future.

Technologies

• SQL, Python, Sigma, YARA-L
• OCSF, CIM
• MITRE ATT&CK
• NetFlow, PCAP, VPC flow logs
• DNS, IPFIX, Zeek
• SIEM, IDS/IPS, NDR

Preferred

• Cyber threat hunting
• Experience with cloud data or security services in AWS, Microsoft Azure, or GCP
• Experience using version control and CI/CD tooling to deploy engineering changes

Location: Denver, CO (onsite)
Compensation (Colorado estimate): $95,600 to $159,300 per year