Data Platform Engineer, Cybersecurity Operations

Citi • Irving, TX

18h • $156,160 - $234,240

About The Position

The Data Platform Engineer will build and operate the scalable data pipelines, storage backbones, and data lakes that support cybersecurity operations. The role ingests and normalizes large volumes of security operations center (SOC) telemetry into modern analytics platforms and involves deep technical architecture and platform engineering. The engineer will make foundational decisions about how security data is stored, queried, and consumed, balancing scalability, cost, performance, and reliability.

The position includes designing and operating batch and streaming pipelines; transforming heterogeneous telemetry into standardized schemas; architecting and maintaining data lakes, warehouses, and streaming stores; and delivering normalized data to analytics, SIEM/XDR, and other downstream systems. It also encompasses performance tuning, reliability and observability, schema and taxonomy governance, telemetry-source onboarding automation, and security and compliance throughout the data lifecycle.

The engineer partners with cybersecurity operations analysts, detection engineers, threat and exposure management teams, and data science teams. The role also requires maintaining architecture documentation, data dictionaries, and operational runbooks. Candidates should be able to lead architecture and system design discussions while also building and operating production systems. The stated education qualification is a bachelor’s degree or equivalent experience; a master’s degree is preferred.

Requirements

• Demonstrable expertise in data platform architecture and engineering, including architecting and operating large-scale, mission-critical platforms and making trade-offs across scalability, cost, performance, and reliability.
• Extensive hands-on experience building and operating large-scale batch and streaming data pipelines using technologies such as Cribl, Kafka, Spark, Flink, Airflow, or equivalent.
• Deep expertise in enterprise-scale data lake and data warehouse architecture, including foundational decisions involving storage formats, partitioning strategies, and query engines.
• Experience with cloud-native data infrastructure on AWS, Azure, or GCP, including storage tiering, cost optimization, and event-driven architectures.
• Strong understanding of security telemetry types, including logs, network flow, endpoint/EDR data, identity events, and cloud audit logs, and the challenges of ingesting and normalizing them at scale.
• Advanced proficiency in a major programming language such as Python, Go, Java, or Scala for pipeline development and automation.
• Deep experience with schema design, data modeling, and metadata management for large, heterogeneous, high-velocity datasets.
• Grounding in cybersecurity fundamentals, particularly SOC/OSVM operations, log management, and detection and analytics use cases.
• Extensive experience with relational, NoSQL, time-series, and columnar/analytical database technologies.
• Strong software engineering fundamentals, including CI/CD, infrastructure as code, version control, automated testing, and observability and monitoring practices.
• Ability to architect for scale and reliability in mission-critical, 24x7 operational environments.
• Cross-functional collaboration skills, including working with security operations, detection engineering, and data science teams.
• Bachelor’s degree, university degree, or equivalent experience.

Nice To Haves

• 10 or more years of experience architecting data platforms specifically for SOC, SIEM, or XDR environments.
• Familiarity with AI/ML pipeline requirements, including feature stores and training data pipelines, for advanced security analytics.
• Deep experience with open table formats such as Iceberg, Delta Lake, and Hudi, and modern lakehouse architectures.
• Relevant certifications, such as cloud data engineering certifications or GIAC certifications.
• Master’s degree.

Responsibilities

• Design, build, and operate scalable, resilient, high-throughput batch and streaming pipelines ingesting security telemetry across the enterprise.
• Develop normalization and enrichment logic to transform varied SOC telemetry into standardized schemas for downstream analytics and detection platforms.
• Architect and maintain the storage backbone, including data lakes, warehouses, and streaming stores, as the durable and queryable source of truth for SOC data.
• Build and operate data lake infrastructure for high-volume security telemetry, balancing cost, performance, retention, and query flexibility.
• Deliver normalized SOC data with low latency to analytics platforms, SIEM/XDR tools, and other downstream systems.
• Tune pipeline throughput, storage partitioning, and query performance as telemetry volumes and analytics needs grow.
• Implement monitoring, alerting, and self-healing capabilities to support pipeline uptime, data completeness, and data quality.
• Define and enforce schemas, taxonomies, and metadata standards across telemetry sources.
• Build reusable frameworks and automation to onboard new telemetry sources.
• Ensure secure handling, encryption, access control, and regulatory compliance for sensitive security data throughout its lifecycle.
• Partner with cybersecurity operations analysts, detection engineers, threat and exposure management teams, and data science teams to meet operational and analytical needs.
• Maintain architecture documentation, data dictionaries, and operational runbooks.

Benefits

• Medical coverage
• Dental coverage
• Vision coverage
• 401(k)
• Life, accident, and disability insurance
• Wellness programs
• Paid time off, including vacation and sick leave
• Paid holidays
• Discretionary and formulaic incentive and retention awards for eligible employees

What This Job Offers

• Job Type: Full-time
• Career Level: Senior