Security Data Engineer
About The Position
We are continuing to build a continuous monitoring & detection programme and need a Splunk Engineer to be a part of the technical foundation of it. This is not a maintenance role - you will be the person who shapes how we collect, normalise, document and operationalise security telemetry across the organisation. You will work directly with the Continuous Monitoring & Detection function to ensure every detection rule has a validated, high-fidelity data source behind it. You will work on the ingestion pipeline, the health of our log sources, and the quality of the data our CSIRT depends on to detect and investigate threats. We operate a tiered ingestion model - we do not ingest everything. You will need to understand why data decisions are made, not just how to implement them. This role sits at the intersection of data engineering and security operations. The right person cares deeply about data quality and understands that a broken pipeline is a security risk, not just an IT problem. As a Security Data Engineer, you will help build and evolve the telemetry foundation that enables BCG's global Continuous Monitoring & Detection capability. Working within Security Operations, you will ensure security data is collected, normalized, and delivered with the quality, consistency, and reliability required to support effective threat detection and incident response. You will partner closely with Detection Engineering, Security Engineering, and Logging Standards to develop scalable data pipelines, improve telemetry health, and guide the technical direction of security data onboarding. In addition to hands-on engineering, you will provide technical leadership across workstreams, mentor colleagues, and help establish engineering standards that improve the resilience and effectiveness of the security monitoring platform.
Requirements
- Experience designing, implementing, and optimizing enterprise security telemetry pipelines using SIEM and related security platforms.
- Deep knowledge of Splunk Enterprise Security, including data onboarding, Common Information Model (CIM) normalization, Enterprise Security content, and platform optimization.
- Strong understanding of data ingestion architectures, field normalization, retention strategies, and telemetry quality management.
- Experience leading technical workstreams and build on engineering standards across security data onboarding and platform operations.
- Familiarity with modern observability and telemetry pipeline technologies, such as Observo, Datadog, or similar platforms, and an understanding of how they complement enterprise SIEM architectures.
- Ability to collaborate across Security Operations, Detection Engineering, Engineering, and Infrastructure teams to deliver scalable, reliable security telemetry.
- A pragmatic, engineering-led approach to balancing data quality, platform performance, detection effectiveness, and operational cost.
- Deep expertise in Python in the context of Data Engineering
Responsibilities
- Design, implement, and optimize security telemetry pipelines that deliver high-quality, detection-ready data into Splunk Enterprise Security.
- Partner with Detection Engineering to translate detection use case requirements into telemetry onboarding, normalisation and data quality improvements
- Lead the onboarding, normalization, and validation of new log sources, ensuring alignment with Common Information Models and enterprise logging standards.
- Develop and maintain performant data ingestion architectures using Splunk forwarders, HTTP Event Collector (HEC), API integrations, and related technologies.
- Partner with Detection Engineers to ensure security telemetry supports accurate, scalable, and high-confidence detection engineering.
- Monitor and improve data quality, ingestion health, pipeline performance, and telemetry reliability through proactive engineering and operational metrics.
- Lead technical workstreams that enhance data onboarding, platform optimization, and security telemetry governance while mentoring engineers through implementation and best practices.
- Optimize ingestion strategies, retention policies, and data lifecycle management to balance detection coverage, platform performance, and operational cost.
- Evaluate and integrate modern telemetry and data pipeline technologies, including platforms such as Observo and Datadog, where they strengthen security monitoring capabilities and operational efficiency.
Benefits
- Zero dollar ($0) health insurance premiums for BCG employees, spouses, and children
- Low $10 (USD) copays for trips to the doctor, urgent care visits and prescriptions for generic drugs
- Dental coverage, including up to $5,000 in orthodontia benefits
- Vision insurance with coverage for both glasses and contact lenses annually
- Reimbursement for gym memberships and other fitness activities
- Fully vested Profit Sharing Retirement Fund contributions made annually, whether you contribute or not, plus the option for employees to make personal contributions to a 401(k) plan
- Paid Parental Leave and other family benefits such as elective egg freezing, surrogacy, and adoption reimbursement
- Generous paid time off including 12 holidays per year, an annual office closure between Christmas and New Years, and 15 vacation days per year (earned at 1.25 days per month)
- Paid sick time on an as needed basis
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
