6+ years of experience in an ISSE, ISSO, or IT role
Experience designing and managing the end-to-end process for ingesting new security data sources into the SIEM such as Elasticsearch, including log collection, shipping, parsing, normalization, and enrichment
Experience with data parsing and normalization, developing and maintaining robust parsing logic to break down raw, unstructured logs into well-defined, queryable fields, owning data schema such as Elastic Common Schema (ECS), and ensuring consistency across all data sources
Experience building automated processes to enrich raw security data with critical context, including adding geolocation data to IP addresses, appending threat intelligence indicators, or adding user role information to account-based events
Experience implementing monitoring and alerting to ensure the health and timeliness of security data pipelines, including identifying and fixing issues such as data loss, parsing errors, or delays that could blind the detection engineers
Ability to optimize data architecture for fast search and query performance, ensuring that complex detection rules can be executed efficiently against large volumes of data without impacting the stability of the platform
TS/SCI clearance
HS diploma or GED
IASAE II Certification such as CASP+, CISSP, or CSSLP Certification
Applicants selected will be subject to a security investigation and may need to meet eligibility requirements for access to classified information; TS/SCI clearance is required.