Security Data Engineer
Cybersecurity Operations
Data
Data Analysis
Data Analytics
Data Engineer
Data Integration
Data Pipeline
Data Processing
Database
Databases
Detection Engineering
Engineer
Information Technology (IT)
IT Security
Network Security
Risk Management
Security
Security Data Engineering
Security Detection Engineering
Security Engineer
Security Engineering
Software Development
SQL
Job Description
Join Deloitte’s Enterprise Security team to support clients with designing, implementing, and improving enterprise security solutions.
Responsibilities
- Design, write, and deploy high-fidelity detection rules using SQL, Sigma, YARA-L, or Python targeting network-based attack techniques such as C2 beaconing, data exfiltration, and lateral movement.
- Continuously tune network detections to reduce false positives while maintaining a high signal-to-noise ratio.
- Determine the telemetry needs for network monitoring, threat hunting, incident response, and custom detection engineering.
- Map detection requirements to underlying data sources and identify visibility gaps across hybrid cloud and on-premises environments.
- Design and maintain telemetry ingestion pipelines for security telemetry from network, endpoint, identity, cloud, application, OT, and security infrastructure.
- Ensure telemetry is delivered reliably to SIEM, data lake, analytics, and detection platforms.
- Troubleshoot ingestion and processing issues including ingestion failures, parsing, latency, and data-quality problems.
- Evaluate whether packet, flow, session, DNS, proxy, authentication, endpoint, and application telemetry is sufficient for specific detection requirements.
- Support custom detection development with data discovery, enrichment, normalization, and validation.
- Identify opportunities to move detections from lower-level indicators toward behavioral and tradecraft-based detection using the Detection Stack.
- Collaborate with network engineering to evaluate network sensor and telemetry technologies, including NetFlow/IPFIX, DNS telemetry, proxy telemetry, firewall logs, IDS/IPS, packet capture, Zeek/network metadata, and NDR platforms.
- Establish telemetry health metrics, dashboards, and automated checks for missing, delayed, or malformed data.
- Assess network visibility across data centers, cloud environments, remote networks, and segmented environments.
- Optimize telemetry architectures and ingestion pipelines for performance, scalability, reliability, and cost.
Requirements
- Bachelor’s degree in Cybersecurity or Information Technology.
- Active TS/SCI or SCI eligibility.
- 4+ years of experience in cybersecurity, enterprise security, or information security.
- 3+ years supporting implementation or administration of security technologies across enterprise environments.
- 3+ years producing technical documentation, status reporting, or client deliverables for security engagements.
Technologies
- SQL
- Sigma
- YARA-L
- Python
- SIEM
- Detection Stack
- NetFlow/IPFIX
- IDS/IPS
- Zeek
- NDR
- Packet capture
Location
- Colorado Springs, CO (onsite)
Salary
- USD 95,600 - 159,300 per year
Benefits
- Eligible for a benefits package competitive for project delivery-focused professionals.
- May be eligible to participate in a discretionary annual incentive program, subject to program rules.
Preferred
- Master’s degree in Cybersecurity, Information Technology, Information Systems, Engineering or related field with 10+ years of related experience.
- Experience supporting government or public sector clients.
- Experience with cloud security, data security, and network security.
Similar Jobs
