Security Data Engineering

Security Data Engineering Cybersecurity Jobs

2 jobs found

Today

Senior Security Engineer- Security Operations

GE Appliances Louisville, KY

Louisville, KY

Today

Full time Senior Cloud Platforms Cybersecurity Operations

Apply Now

Job Description

Senior Security Engineer (Security Operations) to serve as the senior technical lead for GE Appliances’ detection and response capability, focused on SOC engineering, automation, telemetry, and Tier 3 escalation.

Responsibilities

Act as senior technical lead and subject-matter expert for security operations, owning detection and response platform architecture, configuration, and operational health, plus the technical standards the MSSP operates against.
Design, build, test, and maintain detection content including correlation rules, behavioral analytics, and IOC/BIОC rules mapped to MITRE ATT&CK, using detection-as-code practices (version control, testing, peer review, and documentation).
Own telemetry coverage: identify visibility gaps, onboard and normalize log sources across endpoints, identity, Microsoft 365, cloud, network, email, DLP, and OT; monitor ingestion health and manage data volume and retention cost.
Engineer security automation and orchestration (SOAR) playbooks and integrations to enrich alerts, automate containment, and connect security tooling with IT service management and collaboration platforms to reduce manual work and MSSP handling time.
Provide technical oversight of MSSP output in partnership with the Information Security leader who owns the MSSP commercial relationship: review triage and investigation quality, escalation accuracy, and run-book adherence.
Drive false-positive reduction and tuning, and update MSSP run books and playbooks as detections and the environment change.
Serve as the Tier 3 escalation point for complex or high-severity incidents escalated by the MSSP, performing hands-on investigation, endpoint and log analysis, scoping, and containment, and coordinating with an external incident response retainer when engaged.
Lead hypothesis-driven threat hunting using threat intelligence and manufacturing-relevant threats, converting hunt findings into durable detections and hardening recommendations.
Operationalize threat intelligence by translating advisories, vulnerability disclosures, and adversary reporting into detections, hunts, and blocking actions, tracking threat actors relevant to GE Appliances.
Validate detection and response effectiveness through purple-team exercises, adversary emulation, and breach-and-attack simulation, measuring coverage against MITRE ATT&CK and confirming expected MSSP detection and response.
Maintain EDR/XDR platform health across endpoint and server estate: agent coverage, prevention and exploit-protection policies, exclusions governance, and response actions.
Strengthen the technical side of vulnerability operations run by the MSSP: scan coverage and authenticated scanning, risk-based prioritization using exploitability and threat intelligence (CISA KEV, EPSS), correlate vulnerabilities with active threat activity, and automate remediation workflows.
Partner with Cloud, Network, and Identity security engineers to integrate CNAPP, network, and identity signals into detection and response, including identity threat detection for account takeover, MFA fatigue, and AiTM phishing.
Partner with OT Security to extend monitoring and detection into manufacturing in a production-safe manner aligned with ISA/IEC 62443 and NIST SP 800-82.
Author and maintain incident response playbooks, technical run books, and tabletop exercise scenarios; lead technical portions of post-incident reviews to drive corrective actions to closure.
Define, automate, and report operational metrics and KPIs (MTTD, MTTR, ATT&CK detection coverage, false-positive rate, log source health, MSSP escalation quality) to the CISO and Information Security leadership.
Contribute to the security operations roadmap: evaluate emerging capabilities including AI-assisted triage and agentic SOC automation; support platform evaluations, proofs of concept, and TCO analyses.
Provide technical evidence for logging, monitoring, and incident response controls in SOX, C-SOX, PCI-DSS, and other audits, and drive remediation of related findings.
Mentor engineers and transfer knowledge to MSSP analysts on GE Appliances environment, detections, and response procedures.

Requirements

Bachelor’s degree in Information Systems, Cybersecurity, Computer Science, or a related technical field, or equivalent practical experience.
6–10 years progressive experience in IT or information security, including 4+ years hands-on experience in security operations, detection engineering, or incident response in a large enterprise environment.
Deep hands-on experience engineering and administering SIEM/SOAR and EDR/XDR platforms, including writing detection rules and queries (XQL, SPL, KQL), with examples such as Cortex XSIAM/XDR, Splunk, Microsoft Sentinel/Defender, and CrowdStrike.
Proven experience building detection content mapped to MITRE ATT&CK and tuning it for fidelity at enterprise scale.
Experience building SOAR playbooks and integrations; proficiency in Python and/or PowerShell and working with REST APIs and JSON.
Hands-on incident response experience with significant enterprise incidents such as ransomware, BEC, and account takeover, including endpoint, log, and network analysis.
Experience in a MSSP/MDR technical oversight role, including tuning, escalation quality review, and run-book development.
Strong understanding of log sources and telemetry across Windows, Linux, network, cloud (AWS, Azure, and/or GCP), Microsoft 365, and identity providers.
Working knowledge of MITRE ATT&CK, NIST SP 800-61, NIST CSF, and CIS Controls.
Excellent verbal and written communication skills for both technical and executive audiences.

Technologies

Palo Alto Networks Cortex XSIAM/XDR
Splunk
Microsoft Sentinel/Defender
CrowdStrike
XQL, SPL, KQL
Python, PowerShell
REST APIs, JSON
MITRE ATT&CK, SOAR, SIEM, EDR, XDR
Microsoft 365, CNAPP
CISA KEV, EPSS
ISA/IEC 62443, NIST SP 800-82, NIST SP 800-61, NIST CSF
CIS Controls
SOX, C-SOX, PCI-DSS
Detection-as-code, Git, Sigma, Atomic Red Team, MITRE Caldera

Preferred Qualifications

Certifications such as GIAC (GCIH, GCIA, GCDA, GCFA, GCTI), Palo Alto Networks Cortex certifications, CISSP, or similar.
Experience with detection-as-code practices, Git, CI/CD pipelines, and Sigma or other vendor-neutral rule formats.
Experience with threat hunting, purple teaming, and adversary emulation (Atomic Red Team, MITRE Caldera, breach-and-attack simulation platforms).
Familiarity with OT/ICS monitoring frameworks such as ISA/IEC 62443 or NIST SP 800-82.
Experience integrating cloud security (CNAPP/CSPM) and identity telemetry into detection and response.
Experience applying AI and large language models to security operations, with familiarity of AI security frameworks such as MITRE ATLAS and the OWASP Top 10 for LLM Applications.
Experience in manufacturing, critical infrastructure, or global multinational organizations.

Working Conditions

Normal office environment.
Occasional weekend and/or evening work, including after-hours escalation for major security incidents and participation in an on-call rotation.

Location: Louisville, KY (onsite), USA

View full job page →

3d ago

Cybersecurity Data Engineering Manager

Capital Group Companies New York, NY

New York, NY

3d ago

$173k - $342k/yr Full time Manager Analytics Cloud Data Engineering

Apply Now

Job Description

Capital Group Companies is seeking a Cybersecurity Data Engineering Manager to lead the organization’s cybersecurity analytics and security intelligence efforts. This onsite role in New York, NY focuses on building enterprise-scale security data pipelines, strengthening SIEM engineering, and turning security telemetry and related data into intelligence that supports data-driven decisions. The position combines strategy, hands-on engineering leadership, and expertise across analytics, threat detection, and cyber risk measurement.

Role focus: define and execute cybersecurity analytics, security data engineering, and security intelligence strategy, with an emphasis on SIEM engineering and operating large-scale security data platforms.

Key responsibilities

Define and execute the cybersecurity analytics, security data engineering, and security intelligence strategy for the organization.
Lead a team of cybersecurity data scientists, data engineers, and security engineers to transform security telemetry, operational data, threat intelligence, vulnerability data, cloud security signals, identity data, and business context into actionable intelligence.
Emphasize SIEM engineering and enterprise-scale security data pipelines, including data models and dashboards, managing data ingestion and integration frameworks, and building advanced analytics and reporting to help reduce risk to the firm.

Requirements

Proven leader of data scientists, data engineers, or security data professionals.
Demonstrated ability to lead large, complex programs with significant organizational impact.
Strong stakeholder influence and consensus-building with senior leadership.
Deep knowledge of cybersecurity principles, cyber risk measurement, security operations, threat detection, vulnerability management, cloud security, and security telemetry.
Expertise in statistical modeling, machine learning, predictive analytics, anomaly detection, and behavioral analytics.
Strong understanding of cybersecurity KPIs, KRIs, operational metrics, and risk analytics frameworks.
Deep expertise building large-scale data pipelines, streaming architectures, and data integration platforms.
Extensive experience designing security-focused data models and analytical data structures.
Experience managing enterprise-scale security telemetry and observability platforms.
Strong understanding of data governance, metadata management, lineage, quality management, and regulatory requirements.
Expertise in cloud-native data architectures and modern data platform design.
Proficiency in Python and SQL.
Experience with cloud native technologies such as AWS, Snowflake, Databricks, or similar.
Experience with observability technologies like Cribl, Fluentd, OTEL, or similar.
Experience with dashboarding and visualization technologies.
Strong understanding of cloud infrastructure, distributed computing, and enterprise-scale analytics environments.
Experience building and managing security data platforms such as SIEM, security data lakes, observability platforms, and threat intelligence systems.
12+ years of experience in cybersecurity analytics, data science, data engineering, security operations, or related disciplines.
5+ years leading technical teams.
Bachelor’s degree in Cybersecurity, Computer Science, or a related field.
Experience building security data lakes and enterprise-scale security analytics platforms.
Experience supporting AI-enabled security initiatives and cyber risk measurement programs.
Experience supporting executive reporting, regulatory examinations, and audit requirements.

Technologies

Python, SQL
AWS, Snowflake, Databricks
Cribl, Fluentd, OTEL
SIEM
Security data lakes, observability platforms, threat intelligence systems
Dashboarding and visualization technologies

Compensation

USD 173,072 - 342,072 per year

Benefits

Generous time-away and health benefits from day one, with the opportunity for flexible work options
2-for-1 matching gifts for charitable contributions and the opportunity to secure annual grants for the organizations you love
Access on-demand professional development resources
Competitive salary, bonuses and benefits
Company-funded retirement contribution (retirement contribution will factor in salary and variable pay, including bonuses)
Individual annual performance bonus plus Capital’s annual profitability bonus plus a retirement plan where Capital contributes 15% of your eligible earnings

View full job page →

Security Data Engineering Cybersecurity Jobs

Senior Security Engineer- Security Operations

Cybersecurity Data Engineering Manager

Get Security Data Engineering Cybersecurity Jobs alerts