Cyber Security Data Engineer(Azure Data Explorer)

 seeking a Cyber Security Engineer – Data Engineer, Associate to join the Cyber Security Operations team. This role will help strengthen the Bank’s monitoring, detection, and response capabilities by building, onboarding, and maintaining high-quality security data pipelines across cloud and on-premises environments. The successful candidate will partner with application, infrastructure, security, and governance teams to ensure critical telemetry is collected, normalized, validated, and made available for threat detection, incident response, compliance, and cyber risk visibility.

This is a hands-on engineering role for a candidate who is comfortable working with large volumes of security telemetry, solving complex data quality issues, and improving the reliability, scalability, and efficiency of log ingestion and data integration processes. The role requires strong technical execution, attention to detail, and the ability to collaborate across global teams in a highly regulated financial services environment.

Role Responsibilities

• Design, build, and maintain scalable data ingestion pipelines for onboarding security log sources into SIEM and cloud data platforms, including Azure Data Explorer and Log Analytics.
• Parse, normalize, transform, and enrich structured and unstructured log data using techniques such as regex, JSON parsing, schema mapping, and data validation.
• Partner with application owners, infrastructure teams, cloud teams, vendors, and security stakeholders to onboard new log sources and confirm end-to-end data flow.
• Validate log integrity, completeness, timeliness, and quality to ensure security telemetry is reliable and fit for monitoring, detection, response, and reporting use cases.
• Align onboarded data to organizational standards, schemas, naming conventions, and data governance expectations to support downstream analytics and automation.
• Troubleshoot ingestion, parsing, transformation, and pipeline issues across diverse log sources, platforms, and environments.
• Develop and maintain documentation for log onboarding procedures, data mappings, source requirements, pipeline configurations, and operational support processes.
• Collaborate with detection engineering and SOC teams to ensure onboarded logs support threat detection, investigation, response, and cyber risk visibility requirements.
• Conduct telemetry gap analysis to identify missing, incomplete, or underrepresented data sources and recommend onboarding priorities to improve security coverage.
• Support logging and data collection practices that align with regulatory, audit, compliance, retention, and integrity requirements.
• Improve ingestion frameworks, automation, and onboarding workflows to increase efficiency, repeatability, scalability, and cost effectiveness.
• Support infrastructure-as-code, scripting, and automation approaches where appropriate to streamline deployment and ongoing maintenance.
• Monitor pipeline performance and partner with stakeholders to optimize ingestion reliability, throughput, and cost efficiency.
• Stay current on emerging logging standards, telemetry formats, cybersecurity data engineering practices, and cloud security data platform capabilities.

Qualifications and Skills

• Minimum of 3 years of relevant experience in cybersecurity, data engineering, log management, security operations, or a related technology discipline.
• Hands-on experience onboarding, managing, and validating log sources in SIEM, cloud data platforms, or security analytics environments.
• Strong understanding of data parsing, normalization, transformation, and validation techniques, including regex, JSON, XML, CSV, and structured and unstructured data handling.
• Familiarity with common security telemetry sources, including network, endpoint, identity, application, cloud, and infrastructure logs.
• Experience with cloud platforms and associated logging, monitoring, and analytics services.
• Strong troubleshooting and problem-solving skills related to data pipelines, ingestion flows, schema issues, and data quality defects.
• Understanding of compliance and regulatory expectations related to logging, retention, auditability, and data integrity.
• Experience with scripting or automation tools such as Python, PowerShell, or similar technologies is preferred.
• Familiarity with query languages used to validate, investigate, and analyze ingested data.
• Ability to plan, coordinate, and execute onboarding efforts across multiple internal teams, vendors, and stakeholders.
• Ability to balance operational support responsibilities with project-based delivery and continuous improvement efforts.
• Strong attention to detail, commitment to data quality, and ownership of outcomes.
• Experience in broader cybersecurity disciplines, including threat detection, incident response, vulnerability management, or cloud security, is a plus.
• Ability to work effectively and collaboratively in a global team environment.
• Strong communication skills, sound judgment, and a high degree of accountability.