Security Data Engineer

About the role

Deloitte’s Government & Public Services practice is seeking a Security Data Engineer to join the Enterprise Security team. The role focuses on designing, implementing, and improving detection rules and telemetry pipelines to strengthen clients’ cybersecurity capabilities.

Key responsibilities

• Design, write, and deploy high‑fidelity detection rules using SQL, Sigma, YARA‑L, or Python for network‑based attack techniques.
• Continuously tune detections to reduce false positives while maintaining signal quality.
• Identify and map telemetry requirements to data sources, addressing visibility gaps across hybrid cloud and on‑prem environments.
• Build and maintain pipelines ingesting security telemetry from network, endpoint, identity, cloud, application, OT, and security infrastructure.
• Ensure reliable delivery of telemetry to SIEM, data lake, analytics, and detection platforms, troubleshooting ingestion and data‑quality issues.
• Evaluate and optimize telemetry architectures for performance, scalability, reliability, and cost.

Required profile

• Bachelor’s degree in Cybersecurity or Information Technology.
• Active TS/SCI or SCI eligibility.
• 4+ years of experience in cybersecurity, enterprise security, or information security.
• 3+ years supporting implementation or administration of security technologies across enterprise environments.
• Strong written and verbal communication, attention to detail, and ability to work independently or in a team.

Required skills

• SQL
• Sigma
• YARA‑L
• Python
• Network telemetry (NetFlow/IPFIX, DNS, proxy, firewall logs, IDS/IPS, Zeek, NDR)
• SIEM and data lake technologies
• Cloud, endpoint, identity, and OT security data sources