Security Data Engineer (Cribl)

This is a remote position. The Security Data Engineer will support the South Carolina Department of Administration, Division of Technology Information Security (DIS) on its large-scale enterprise cybersecurity initiatives. The role centers on hands-on Cribl data modeling and log-pipeline design, implementation, routing, transformation, and delivery of security telemetry into enterprise SIEM environments. The Data Engineer will work alongside full-time security architects and engineers to strengthen enterprise security-data operations. Responsibilities also include hands-on security engineering across SIEM, XDR, vulnerability management, DLP, endpoint security, and Linux-based security sensors. The role requires building security automation and integrations using Python and Bash, supporting threat detection, and contributing to defensive security architecture. Responsibilities • Design, build, implement, and maintain Cribl data models and log pipelines. • Develop enterprise security-data ingestion and routing workflows that deliver security telemetry into enterprise SIEM environments. • Perform data parsing, filtering, transformation, enrichment, routing, and normalization of security telemetry. • Support SIEM administration, analysis, and reporting. • Implement and support enterprise security technologies, including XDR, vulnerability-management, DLP, and endpoint-security platforms. • Build and deploy Linux-based security sensors and support Linux and Windows security configuration and hardening. • Develop security automation and integrations using Python and Bash. • Support threat detection, incident-detection activities, and security-control implementation and validation. • Troubleshoot complex security-data and integration issues and support secure networking and system-design initiatives. • Collaborate with enterprise security architects and engineers in architecture discussions and participate in the required on-call rotation. Requirements Minimum Qualifications - Candidates must meet all minimum qualifications • Hands-on Cribl data modeling experience. • Cribl log-pipeline design and implementation experience. • Strong understanding of enterprise security architecture and engineering principles. • Experience implementing and supporting enterprise security tools. • Exposure to SIEM technologies. • Exposure to XDR technologies. • Exposure to vulnerability-management technologies. • Exposure to Data Loss Prevention (DLP) technologies. • Exposure to endpoint-security technologies. • Experience developing automation and integrations using Python and/or Bash. • Knowledge of cybersecurity best practices. • Threat-detection experience. • Defensive-security knowledge. • Linux operating-system experience. • Windows operating-system experience. • System-hardening experience. • Security-configuration experience. • Understanding of networking concepts. • Understanding of security protocols. • Understanding of secure-system design. • 5 years of experience supporting large IT environments and/or enterprise system deployments. • Bachelor's degree in an Information Technology-related or Security-related field, or 8 years of relevant professional experience. Preferred Qualifications • Advanced Cribl Stream experience. • SIEM administration experience. • SIEM analysis experience. • SIEM reporting experience. • Experience with enterprise SIEM platforms such as Splunk, Microsoft Sentinel, IBM QRadar, or Elastic/Elasticsearch. • Experience building and deploying Linux-based security sensors. • Enterprise cybersecurity engineering experience. • Security architecture experience. • Security automation experience. • Security-system integration experience. • Knowledge of the NIST Cybersecurity Framework (NIST CSF). • Knowledge of CJIS requirements. • Knowledge of IRS Publication 1075. • Knowledge of CMS MARS-E. • CISSP certification. • Security+ certification. • Location in or near South Carolina with the ability to occasionally report onsite. Additional Requirements • Successful completion of a 7-year standard criminal background check. • Successful completion of a full credit-history check. • Successful completion of a driving-record (MVR) check. • Successful completion of a 10-panel drug screen. • E-Verify employment eligibility verification. • Successful completion of a SLED check. • Ability to obtain and maintain annual CJIS certification. • Availability for occasional onsite needs in South Carolina if requested; onsite travel is the responsibility of the candidate. • Participation in an on-call roster. Work Location and Schedule Location: Remote within the United States (agency located at 4430 Broad River Road, Columbia, South Carolina 29210). Schedule: Day schedule, 40 hours per week, with on-call roster participation. Work Arrangement: 100% remote, with occasional onsite work in South Carolina if requested. All required experience should be clearly and explicitly documented in the resume. Originally posted on Himalayas