Cyber Security Platform Engineer – Cyber Defense

• Architect and engineer scalable, cloud-native SIEM solutions, utilizing Infrastructure-as-Code principles to manage log ingestion pipelines and storage.
• Develop and maintain robust data pipelines to ingest, transform, and normalize security logs from diverse endpoints (APIs, cloud platforms, firewalls) into the SIEM, ensuring high data fidelity and low latency.
• Write and optimize custom parsers using Regex and scripting languages to map raw log data to standardized security models, ensuring consistent data structures for analysis.
• Program custom integrations connecting third‑party tools and streaming data sources to the SIEM via REST APIs and webhooks.
• Collaborate with DevOps and Application teams to define logging standards and embed security telemetry requirements early in the software development lifecycle (SDLC).
• Manage the full lifecycle of the SIEM platform, including health monitoring, troubleshooting ingestion failures, and debugging parsing errors to ensure 24/7 availability.
• Proactively analyze ingestion volume against capacity limits to identify optimization opportunities, implementing granular log tuning and exclusion rules that minimize licensing costs and maximize the signal-to-noise ratio.
• Engineer automated provisioning workflows using Infrastructure as Code (IaC) to programmatically manage both the underlying infrastructure and complex IAM policies supporting the security platforms.

Requirements

• Bachelor’s degree in Computer Science, Cyber Security, Information Systems or related field.
• 6+ years of overall software engineering experience.
• 2+ years of technical experience designing and maintaining scalable security data architectures.
• Skilled in configuring cloud‑native security & SIEM/SOAR platforms.
• Experience with security logging, data sources, log parsing & tuning and industry best practices for log ingestion.
• Experience administering cloud‑native security platforms, with a specific focus on maintaining platform health, troubleshooting configuration issues, and managing complex IAM roles to ensure granular access control.
• 2+ years hands‑on development experience on cloud native platforms, preferably Google Cloud Platform.
• Even better, you may have...
• Proficiency in scripting languages like Python, Go, Java, or Bash for automation, data manipulation, and integration tasks.
• Hands‑on experience setting up CI/CD pipelines. OpenShift Tekton, or GitHub Actions or similar.
• Knowledge of secure coding practices.
• Experience setting up serverless functions using GCP Cloud Run or Cloud functions, and configuring the respective service for scaling.
• Robust knowledge of system design principles including reliability, availability, and scalability.
• Experience setting up logging and monitoring services (Dynatrace, GCP Ops Suites).
• Strong understanding of network security, log analysis, threat detection, and incident response.
• Knowledge of RESTful APIs, data integration techniques, and infrastructure-as-code tools (e.g., Terraform, Ansible).