Threat Detection & Automation Engineer (with focus on Data Engineering)

Northwestern Mutual • Milwaukee, WI

6d • Hybrid

About The Position

We are looking for a highly motivated Security Automation Engineer with experience in Data Engineering to join NM’s Security Automation & Data Analytics team. As a member of our team, you will play a pivotal role in designing, building and maintaining continuous and sustainable automated pipelines with the goal of enhancing the efficiency, effectiveness and accuracy of cybersecurity teams’ capabilities reducing manual tasks for the IRC teams and enable data-driven cybersecurity operations. This role requires a mix of modern data engineering practices, experience in database structures and tooling, coding, cloud development, and security domain expertise.

Requirements

• 5+ years of professional development experience using SQL and Python.
• 5+ years of professional experience building data pipelines ( batch and/or streaming ) and data governance practices.
• Hands-on experience with modern data warehouses and large-scale data platforms; comfortable working across large-scale, structured and unstructured data.
• Deep understanding of database structures principles and best practices
• Deep understanding of data modeling, ETL/ELT design, data engineering best practices, including data integration patterns, replication, event streaming, and pipeline performance tuning.
• Hands-on experience with security automation and orchestration tools and/or software development technologies.
• Comfortable with REST API best practices and usage.
• Hands-on experience deploying content and/or systems through CI/CD environments, and tooling such as GitLab, GitLab CI, Terraform, Ansible, Kubernetes etc.
• Hands-on experience with AWS and cloud services configuration and development.
• Excellent written and verbal communications skills.
• Ability to communicate with technical and non-technical audiences.

Nice To Haves

• Bachelor's degree in computer science, Cybersecurity, Computer Engineering, Data Engineering, Software Engineering, or related fields
• Relevant industry certifications are preferred, such as AWS Certified Data Engineer – Associate, Databricks Certified Data Engineer Associate, or Databricks Certified Data Engineer Professional, demonstrating expertise in modern cloud-based data engineering, analytics, and data platform technologies.
• Experience with Databricks
• Experience with Splunk SOAR (Phantom) and Splunk SIEM.
• Experience with Splunk SPL queries, dashboards, and alerts.
• Experience with ServiceNow development and ServiceNow data lake
• Practical experience with automation techniques using PowerShell, Bash, JavaScript, API calls, and regular expressions
• Additional coding experience in one or more programming languages – Java, C++, Go
• ServiceNow development experience
• Experience with network and/or systems administration
• Experience working in Security Operations, Incident Response, or Penetration Testing
• Hands-on experience with security technologies such as SIEM, firewalls, IDR/IPS, EDR, IAM principles and others.

Responsibilities

• Design, develop, and maintain scalable data pipelines, datasets, and analytics products supporting IRC department’s reporting and analytics capabilities.
• Develop and maintain enterprise-ready ETL/ELT processes and data transformation frameworks to support data-driven initiatives.
• Design, build and support cloud-based data pipelines and data lake architectures using software and data engineering best practices.
• Ensure data quality, lineage, integrity, and governance standards are implemented throughout the data lifecycle.
• Optimize and troubleshoot existing data pipelines for performance and reliability, ensuring data quality and integrity across various data sources.
• Identify opportunities to automate workflows/processes and improve efficiency across cybersecurity teams through SOAR playbooks and Kubernetes-hosted and/or cloud-hosted pipelines.
• Assist with the design, engineering, deployment, and maintenance of custom automation tools (primarily in Python and PowerShell)
• Develop integrations with security tools and APIs.
• Evaluate and implement emerging technologies to improve cybersecurity and analytics capabilities
• Assist with the development and support of dashboards, metrics, and monitoring alerts related to the team’s and the department’s operations.
• Develop and maintain documentation related to the team’s automated workflows/products.
• Partner with data scientists, analysts, engineers, and other stakeholders to identify requirements and deliver high-quality solutions and insights.
• Provide mentorship and coaching to junior team members, fostering skill development and encouraging continuous learning.

Benefits

• Pay Range - Start: $130,800.00
• Pay Range - End: $196,200.00
• Structure 110: $143,920.00 USD - $215,880.00 USD
• Structure 115: $150,400.00 USD - $225,600.00 USD
• Geographic specific pay structures, compensation and benefits could be applicable

What This Job Offers

• Job Type: Full-time
• Career Level: Senior