Senior Engineer - SIEM, Cribl, Onum

Position Overview:

The Senior Engineer, Security Telemetry & Detection Platforms will design, build, and optimize enterprise-scale telemetry pipelines and detection systems leveraging platforms such as Onum, Cribl, and SIEM technologies. This role focuses on enabling high-fidelity security visibility, improving data efficiency, and delivering scalable, real-time detection capabilities across distributed cloud and hybrid environments.

Responsibilities:

• Architect and implement large-scale telemetry pipelines using Cribl and Onum for data routing, enrichment, filtering, and cost optimization
• Design and optimize SIEM ingestion pipelines to support high-volume, high-velocity security event processing
• Develop and maintain data normalization, parsing, and enrichment strategies aligned to detection engineering needs
• Build reusable pipeline components and configurations to standardize telemetry processing across environments
• Integrate diverse data sources including cloud logs, endpoint telemetry, network data, and SaaS platforms
• Tune and optimize pipelines for performance, cost efficiency, and data fidelity
• Collaborate with security and detection engineering teams to improve signal-to-noise ratio and detection coverage
• Perform root cause analysis on pipeline issues, data gaps, and ingestion failures
• Implement observability and monitoring for telemetry pipelines and SIEM health
• Lead design reviews with focus on scalability, resiliency, and security best practices
• Mentor team members on telemetry engineering, SIEM optimization, and pipeline architecture

Qualifications:

• 8+ years of experience in security engineering, SIEM engineering, or telemetry pipeline development
• 3+ years of hands-on experience with Cribl (Stream/Edge/Search) or similar observability/data pipeline tools
• Experience working with Onum (or equivalent data pipeline optimization platforms) for log reduction and signal shaping
• Strong experience with SIEM platforms such as Splunk, Azure Sentinel, QRadar, or Elastic
• Deep understanding of log ingestion, parsing, enrichment, and normalization techniques
• Strong troubleshooting skills across distributed systems and data pipelines
• Experience integrating cloud-native log sources (AWS, Azure, Google Cloud Platform) into SIEM platforms
• Familiarity with scripting or programming (Python, Go, or similar) for pipeline automation and transformation

Tools and Technologies:

• Telemetry & Data Pipeline Platforms: Cribl, Onum, Kafka, Fluentd/Fluent Bit
• SIEM Technologies: Splunk, Microsoft Sentinel, Elastic, QRadar
• Cloud Platforms: AWS, Azure, or Google Cloud Platform
• Data Formats & Protocols: JSON, Syslog, REST APIs, streaming frameworks
• Infrastructure: Kubernetes, Docker, distributed systems architectures

Bonus Qualifications:

• Experience in detection engineering or threat detection use case development
• Familiarity with SIEM cost optimization strategies and licensing models
• Hands-on experience with real-time streaming platforms such as Kafka or Pulsar
• Knowledge of security frameworks such as MITRE ATT&CK
• Experience building or tuning log pipelines at scale (terabytes per day)
• Exposure to NG-SIEM and security analytics platforms
• Contributions to internal or open-source telemetry tooling