Senior Data and Security Engineer

• Pipeline Optimisation & Enrichment: Manage log ingestion pipelines on a Cribl cloud platform. You will intelligently help route, collate, filter, and normalise logs, ensuring data is tagged as soon as possible and enriched at the edge.
  
  
• AWS Cloud Telemetry Integrity: Support the end-to-end flow of AWS security telemetry (CloudTrail management and data events, VPC Flow Logs, GuardDuty findings, EKS/container audit logs, and IAM activity) into the centralised log architecture.
  
  
• Stream Processing & Pipeline Optimisation (Cribl Stream): Leverage stream processing (ideally Cribl) to parse, route, mask sensitive fields, and filter out high-volume, low-value debug noise before indexing into Splunk to maximise detection visibility.
  
  
• Data Normalisation: Build and maintain efficient Splunk data models, accelerated searches, and field extractions mapped to OCSF, ensuring fast query performance and portable detection logic.
  
  
• Troubleshooting Pipeline Bottlenecks: Diagnose and resolve systemic transport failure modes: SQS/S3 ingestion lag, universal forwarder dropouts, unparsed JSON structures, Cribl pipeline backpressure, and source type schema mismatches.
  
  
• Advanced Log Management: Optimise log sources by summarising NetFlow data, trimming bulk data to remove unnecessary payloads, deduplicating identical logs, and pre-parsing complex regex strings.
  
  
• Storage Architecture: Manage real-time streaming technologies (e.g., Kinesis) and security data storage solutions including S3 buckets and Amazon Security Lake.
  
  
• Data Tiering: Support the classification of data into appropriate storage tiers—Hot (security events), Warm (application and performance), and Cold (compliance)—to reduce volume overhead and optimise costs.
  
  
• Secure Ingestion: Verify that all data in transit and at rest is fully encrypted (KMS & TLS). Ensure all fields are normalised into standard schemas (OCSF) while enforcing least-privilege access controls.

Security Engineering & Detection

• SIEM & EDR Logic Development: Support analysts in the creation and tuning of detection rules across platforms.
  
  
• Detection Quality Assurance: Act as an enabler to establish and maintain regular monitoring cycles for detection rules, helping calculate Signal-to-Noise Ratios and rule trust scores to ensure high-fidelity alerting.

• Cloud Platforms: Proven hands-on experience designing and securing cloud infrastructures within AWS, and ideally with Azure and Google Cloud Platform.
  
  
• SIEM & Detection: Experience in supporting analysts in the creation of Splunk (SPL) detection rules.
  
  
• Data Tools & Protocols: Hands-on experience with Cribl, Kinesis, S3 buckets, and SQS Queues. Understanding of OCSF schemas and data normalisation.
  
  
• Security Controls: Deep understanding of Zero Trust, identity-first security, secrets management (KMS), and network segmentation.

• Public Sector Experience: Prior experience working with or alongside UK Government Civil Servants.
  
  
• Assurance Requirements: A good understanding of public sector security assurance requirements and the ability to operate within these regulatory environments.

• Excellent Communication Skills: You will have excellent verbal and written skills, and you will appreciate the need for good engineering discipline.
  
  
• Proportionate Judgement: You approach every engagement on its own terms, selecting and adapting frameworks and methodologies to fit the actual risk and context. You avoid "one-size-fits-all" approaches in favour of what is appropriate for the scale and complexity of the project.
  
  
• Credibility with Clients: You build trusted relationships with senior stakeholders by engaging directly with their concerns.
  
  
• Delivery Focus: You maintain momentum by taking ownership of outcomes. You view security engineering as a critical component that enables good delivery rather than a process that slows it down.

• Impactful Work: The opportunity to work on high-impact public sector services that millions of people rely on daily.
  
  
• Multidisciplinary Environment: Work within diverse teams alongside delivery managers, engineers, and architects.
  
  
• Structured Development: Investment in your growth through internal communities of practice and structured career development.
  
  
• External Engagement: Support for thought leadership, including contributing to cross-government security forums, speaking at events, and developing expertise in the emerging UK government security landscape.