[Hiring] Security Data Engineer @Air InfoSec, LLC

Role Description

This is a remote position. The Security Data Engineer will support the South Carolina Department of Administration, Division of Technology Information Security (DIS) on its large-scale enterprise cybersecurity initiatives. The role centers on hands-on Cribl data modeling and log-pipeline design, implementation, routing, transformation, and delivery of security telemetry into enterprise SIEM environments. The Data Engineer will work alongside full-time security architects and engineers to strengthen enterprise security-data operations. Responsibilities also include hands-on security engineering across SIEM, XDR, vulnerability management, DLP, endpoint security, and Linux-based security sensors. The role requires building security automation and integrations using Python and Bash, supporting threat detection, and contributing to defensive security architecture.

Responsibilities

• Design, build, implement, and maintain Cribl data models and log pipelines.
• Develop enterprise security-data ingestion and routing workflows that deliver security telemetry into enterprise SIEM environments.
• Perform data parsing, filtering, transformation, enrichment, routing, and normalization of security telemetry.
• Support SIEM administration, analysis, and reporting.
• Implement and support enterprise security technologies, including XDR, vulnerability-management, DLP, and endpoint-security platforms.
• Build and deploy Linux-based security sensors and support Linux and Windows security configuration and hardening.
• Develop security automation and integrations using Python and Bash.
• Support threat detection, incident-detection activities, and security-control implementation and validation.
• Troubleshoot complex security-data and integration issues and support secure networking and system-design initiatives.
• Collaborate with enterprise security architects and engineers in architecture discussions and participate in the required on-call rotation.

Qualifications

• Hands-on Cribl data modeling experience.
• Cribl log-pipeline design and implementation experience.
• Strong understanding of enterprise security architecture and engineering principles.
• Experience implementing and supporting enterprise security tools.
• Exposure to SIEM technologies.
• Exposure to XDR technologies.
• Exposure to vulnerability-management technologies.
• Exposure to Data Loss Prevention (DLP) technologies.
• Exposure to endpoint-security technologies.
• Experience developing automation and integrations using Python and/or Bash.
• Knowledge of cybersecurity best practices.
• Threat-detection experience.
• Defensive-security knowledge.
• Linux operating-system experience.
• Windows operating-system experience.
• System-hardening experience.
• Security-configuration experience.
• Understanding of networking concepts.
• Understanding of security protocols.
• Understanding of secure-system design.
• 5 years of experience supporting large IT environments and/or enterprise system deployments.
• Bachelor's degree in an Information Technology-related or Security-related field, or 8 years of relevant professional experience.

Preferred Qualifications

• Advanced Cribl Stream experience.
• SIEM administration experience.
• SIEM analysis experience.
• SIEM reporting experience.
• Experience with enterprise SIEM platforms such as Splunk, Microsoft Sentinel, IBM QRadar, or Elastic/Elasticsearch.
• Experience building and deploying Linux-based security sensors.
• Enterprise cybersecurity engineering experience.
• Security architecture experience.
• Security automation experience.
• Security-system integration experience.
• Knowledge of the NIST Cybersecurity Framework (NIST CSF).
• Knowledge of CJIS requirements.
• Knowledge of IRS Publication 1075.
• Knowledge of CMS MARS-E.
• CISSP certification.
• Security+ certification.
• Location in or near South Carolina with the ability to occasionally report onsite.

Additional Requirements

• Successful completion of a 7-year standard criminal background check.
• Successful completion of a full credit-history check.
• Successful completion of a driving-record (MVR) check.
• Successful completion of a 10-panel drug screen.
• E-Verify employment eligibility verification.
• Successful completion of a SLED check.
• Ability to obtain and maintain annual CJIS certification.
• Availability for occasional onsite needs in South Carolina if requested; onsite travel is the responsibility of the candidate.
• Participation in an on-call roster.

Work Location and Schedule

• Location: Remote within the United States (agency located at 4430 Broad River Road, Columbia, South Carolina 29210).
• Schedule: Day schedule, 40 hours per week, with on-call roster participation.
• Work Arrangement: 100% remote, with occasional onsite work in South Carolina if requested.