Principal Information Security Engineer

FAI

About The Position

This senior technical role supports, matures, and expands the Security Operations Center’s (SOC) logging and monitoring capabilities. It requires an interdisciplinary technical background spanning systems and application administration, data engineering, security operations, and detection engineering. The engineer designs, implements, and maintains Splunk and Cribl infrastructure; supports multi-cloud deployments; and improves how security data is routed, parsed, filtered, normalized, and analyzed. The role leads SIEM detection engineering, contributes to proactive threat detection using analytics and machine learning, participates in purple-team activities, and identifies automation opportunities. It also involves collaboration across teams to mitigate risks, auditing security configurations and procedures, staying current on security practices, and providing guidance to security engineers. Duties may occasionally be required outside normal work hours, including operational on-call support and ad hoc requirements.

Requirements

A bachelor’s degree in computer science, information technology, cybersecurity, or a related field, or equivalent work experience.
At least 10 years of information security experience, with a strong focus on SIEM, data management, and security operations.
Extensive experience deploying, configuring, optimizing, administering, and using SIEM and data management platforms, particularly Splunk and Cribl.
Strong understanding of network protocols, firewalls, intrusion detection systems, endpoint security solutions, and major cloud environments including Azure, AWS, and GCP.
Demonstrated ability to deploy, configure, and secure infrastructure in Azure, AWS, and GCP.
Proficiency in scripting languages such as Python, PowerShell, or Bash for automation and task simplification.
Strong understanding of security frameworks such as MITRE ATT&CK.
Hands-on experience developing, tuning, and deploying SIEM security detections.
Excellent analytical skills to identify, analyze, and resolve complex engineering issues.
Knowledge of security frameworks and standards such as COBIT, NIST 800-53, ISO 27001, SSAE16, SOC 1, and SOC 2.
Proficiency in Microsoft Word, Excel, PowerPoint, and Visio, and ability to create clear technical documentation and presentations.
Strong verbal, written, and presentation skills.
Ability to manage multiple high-priority projects and tasks while aligning work with strategic security goals.
Ability to collaborate in a team-oriented environment, lead by example, and foster collaboration and continuous improvement.

Nice To Haves

Experience using Cursor, ChatGPT, or similar AI platforms to support engineering work.
Familiarity with Azure DevOps work tracking or delivery workflows.
Experience with scripting or automation using Python, Bash, or PowerShell.
Splunk or Cribl certifications or relevant training.
Familiarity with APIs, syslog, forwarders, cloud integrations, and common security or observability data sources.
Experience with IT service management, change management, and vulnerability remediation workflows.
Familiarity with cloud platforms, containers, or infrastructure-as-code.
Relevant certifications such as Splunk Certified Power User/Admin, Cribl Certified Admin, Security+, CEH, OSCP, or CISSP.
Experience with AWS Lambda and Azure Functions.

Responsibilities

Design, implement, and maintain Splunk infrastructure, including upgrades to Splunk and Cribl.
Onboard data to Cribl using REST APIs, S3 collectors, HEC, and related methods.
Implement and support multi-cloud infrastructure deployments.
Use data management platforms and other tools to route, parse, and filter data efficiently.
Apply data engineering practices, including data warehousing, real-time processing, and data normalization, to improve the data infrastructure.
Use SIEM and data management platforms to collect, analyze, and correlate logs.
Lead SIEM detection engineering by developing and tuning correlation rules, alerts, and dashboards to detect and respond to threats.
Help expand data engineering practices, using advanced analytics and machine learning for proactive threat detection.
Participate in the purple-team lifecycle and collaborate with offensive and defensive security teams to improve detection and response strategies.
Identify and implement automation opportunities for SIEM and data management operations.
Collaborate with cross-functional teams to identify and mitigate security risks and vulnerabilities.
Audit security configurations, policies, and procedures for compliance with industry standards and regulations.
Stay current on security trends, tools, and best practices to enhance SIEM capabilities.
Provide guidance and support to security engineers.
Map onboarded data-source fields to appropriate CIM fields and data models, and address normalization gaps.
Create technical documentation and presentations.
Provide operational on-call support and perform other duties outside normal work hours when required by business needs.