Overview
We require three Senior Security Observability Engineers to build and operationalize observability capabilities across the SIEM ecosystem. These resources will lead efforts in designing integrated monitoring solutions for tools like Cribl, Vector, Splunk, Snowflake, ADX, and Log Analytics. Their work will ensure continuous visibility into system health, enabling proactive fault detection and performance management. These resources will leverage either or both Grafana and Power BI for dashboarding.
Work Required
Lead the architecture and implementation of a comprehensive observability strategy across the entire SIEM modernization ecosystem, spanning data pipeline layers (Cribl, Vector, NiFi), event transport (Event Hubs), intermediate storage (Blob), and multiple downstream platforms (Splunk, Snowflake, ADX, Log Analytics, Anvilogic).
Design and build end-to-end telemetry and traceability for data events as they move across platforms, enabling real-time visibility into ingestion, transformation, routing, and storage processes.
Develop and maintain dashboards and alerting mechanisms to detect:
oFaults and failures (e.g., dropped messages, ingestion lags, retry loops)
oLatency or throughput bottlenecks across pipelines
oSchema mismatches or format errors
Duplicate, delayed, or missing data
o Data quality anomalies at point of ingestion and final storage
Instrument each pipeline component (e.g., Cribl workers, Vector agents, NiFi processors) with health and performance metrics, using native exporters, APIs, or custom collectors.
Ensure observability tooling is in place for Azure Event Hubs, including partition health, consumer group lag, and throttling events.
Monitor Blob storage utilization and access patterns to identify ingest failures, access permission issues, or object lifecycle gaps.
Implement and enforce correlation IDs or tracing metadata to follow data across systems and detect where in the pipeline an issue originates.
Integrate monitoring solutions with Grafana, Azure Monitor, and PowerBI to support multiple stakeholder needs (technical, operational, and executive-level views).
Partner closely with Security Engineering, Platform Engineering, and Data Engineering to ensure observability insights are actionable and result in measurable improvements.
Automate reporting of SLO/SLA adherence for pipeline uptime, data integrity, and ingestion latency.
Design alert routing and severity classification, ensuring appropriate escalation workflows via systems such as PagerDuty, ServiceNow, or Microsoft Teams.
Never miss an opportunity! Create an alert based on the job you applied for.
