Title: Senior Security Engineer (Kusto)
Location: Remote
Duration: 6 Months
We are looking for a hands-on Senior Security Engineer to build the data foundation behind the client's security risk reporting.
The role brings vulnerability and security findings from tools such as Qualys, Wiz and Xray/SBOM into one curated dataset via Kusto. That dataset gives leadership one trusted view of exposure, connects every finding to an accountable owner, and drives risk-based prioritization in ServiceNow Vulnerability Response and leadership dashboards.
This is a senior individual-contributor role with a high degree of autonomy. You will design and build the pipeline yourself, guide two contract engineers’ day to day, and own the pipeline's data controls after go-live. The first release is planned for late January 2027, so the right candidate can contribute from the first week.
What you will do
Design the common finding model. Define the shared schema and unique finding keys across Qualys, Wiz, Xray/SBOM and other security sources.
Build normalization and deduplication in Kusto. Turn raw source data into one record per finding using KQL, update policies and materialized views.
Enrich findings with business context. Map every finding to its Application ID, CMDB configuration item, business unit, owner and environment, working with CMDB and CI-matching teams.
Implement prioritization logic. Apply severity, exploitability, asset and business criticality consistently across all sources.
Build ingestion with Ziggiz. Stand up and harden connectors and refresh schedules so sources land in Kusto reliably.
Guide the contract engineers. Provide day-to-day technical guidance, review code and, with the project lead, keep ingestion, reporting and ServiceNow Vulnerability Response integration work aligned.
Own the data controls. Run source-to-dashboard reconciliation, data lineage and data-quality checks, and produce evidence for audit and risk reviews.
Migrate and retire legacy logic. Rebuild priority transformations from the current CloudQuery and dbt pipeline in Kusto and support the cutover.
Own the pipeline in BAU. After go-live, run and evolve the platform, and mentor and onboard the engineers who support it.
Qualifications
Required
6 to 8+ years in data engineering, security engineering or a closely related field, including senior-level ownership of production systems.
In-depth knowledge of large enterprise technology environments, including CMDB and Application ID models, access and change processes, and vulnerability management programs.
Strong, hands-on Kusto (Azure Data Explorer) and KQL: data modeling, ingestion, update policies, materialized views and performance tuning.
Proven experience building production data pipelines that normalize, deduplicate and join data from many sources.
Working knowledge of vulnerability and security tooling data, such as Qualys, Wiz, SBOM/Xray, CrowdStrike or SAST/SCA tools.
Experience designing data-quality and reconciliation controls in a regulated environment.
Ability to guide other engineers through design and code review and explain data and risk trade-offs to senior leaders.
Preferred
In-depth understanding of governance and compliance requirements, including control ownership, audit evidence and risk reviews.
Experience with Ziggiz or similar ingestion platforms, and with dbt or CloudQuery.
ServiceNow Vulnerability Response or ServiceNow CMDB data-integration experience.
Grafana or similar dashboarding on top of Kusto.
Familiarity with risk-based vulnerability prioritization (CVSS, EPSS, exploitability and asset criticality).
Background in financial services or another highly regulated industry.
What success looks like in your first 75 days
- Week 1: set up Kusto and Ziggiz access, and begin Qualys and Wiz connectors.
- By mid-December: common finding model and deduplication keys agreed; first sources refreshing in Kusto.
- By mid-January: normalized, deduplicated findings enriched with Application ID, CMDB and owner data.
- By late January: first release live, with leadership dashboards running on curated Kusto data.
After the first release, you will deliver the remaining sources, the ServiceNow Vulnerability Response integration and the legacy cutover. You will then own the platform in BAU.
