Senior Security Engineer – Data Pipeline & Observability - Mid-Atlantic region (Remote)

Title: Senior Security Engineer – Data Pipeline & Observability - Mid-Atlantic region (Remote) Location: Remote

General Description

GuidePoint is both a Value-Added Reseller (VAR) and a professional services organization, and an award winning Cribl partner (Cribl Americas Solution Provider Partner of the Year, 2026). In this role you will work directly with our vendor partners and account teams, see the same problems across many client environments, and keep up with a market that is changing quickly.

Security data is growing faster than security budgets. Clients come to us because their SIEM bill is out of control, their data is inconsistent, or they are moving platforms and need the data to arrive clean. You will design and build the pipelines that fix those problems, and you will explain the cost and security trade-offs to the people who pay for them

About our Mid-Atlantic SecOps practice

Our team of data engineers, SecOps engineers, consultants, architects, and platform specialists focuses on data integration, normalization, quality, routing, retention, and platform optimization. We partner with clients, account executives, project managers, source-system owners, security teams, and technology providers to create supportable data services.

Key areas of focus include:

• Establishing reliable and reusable data pipelines.
• Improving data quality, accessibility, and processing efficiency.
• Supporting security, observability, analytics, and operational use cases.

Roles and Responsibilities:  

• Architect, deploy, and optimize telemetry pipelines with Cribl Stream, Edge, Lake, and Search, and with comparable platforms such as SentinelOne AI Data Pipelines (Observo AI), CrowdStrike Onum, Palo Alto Networks Chronosphere, Datadog Observability Pipelines (Vector), Splunk Edge Processor, and the OpenTelemetry Collector
• Onboard, parse, and normalize data from syslog, agents, cloud provider logs, SaaS APIs, identity (Microsoft Entra ID, Okta), EDR, and network sources into common schemas (OCSF, Splunk CIM, Elastic ECS, Google UDM)
• Build reduction, filtering, enrichment, and tiering strategies that send only high value data to premium analytics platforms, keep full fidelity copies in low cost storage, and support replay on demand
• Quantify the business cases of baseline ingest, model savings, and present before and after results to technical and financial stakeholders
• Brief client senior leadership (CISO, CIO, CFO) on findings, progress, and recommendations, framed around the customer’s measured business goals (cost avoided, coverage gained, risk reduced, time to investigate) rather than the technical components alone
• Size and harden deployments, including worker topology, high availability and disaster recovery, queuing and backpressure, and fleet health monitoring, across on-premises, cloud, hybrid, and regulated environments
• Build governance into the data flow with masking and redaction of sensitive data, role-based access control, TLS/PKI, and retention policy
• Lead the data workstream of SIEM and platform migrations (for example Splunk, Elastic, Microsoft Sentinel, Google SecOps, CrowdStrike Falcon Next-Gen SIEM, SentinelOne AI SIEM)
• Deliver pipeline health checks and optimization assessments with prioritized, actionable roadmaps
• Support pre-sales by joining scoping calls with Solutions Architects and account teams, estimate level of effort, and contribute to statements of work
• Work with vendor partner engineering teams on joint delivery, escalations, and product feedback and maintain current partner certifications
• Work alongside Detection & Response and Automation & AI engineers to establish clean and well routed data to help make detection content, automation, and AI SOC agents more effective for our customers.
• Serve as the technical point of contact on engagements, with clear progress reporting, as-built documentation, runbooks, and knowledge transfer to client teams
• Contribute to practice intellectual property, including reusable packs, delivery playbooks, and effort baselines, and mentor other engineers

Required Experience and Education:

• 5+ years in cybersecurity, IT operations, or data engineering, including 3+ years building and running production telemetry pipelines
• Hands-on production experience with Cribl Stream or a comparable pipeline platform
• Working knowledge of at least one SIEM or analytics destination (Splunk, Elastic, Microsoft Sentinel, Google SecOps, CrowdStrike, or SentinelOne), enough to know what the data must look like when it arrives
• Client-facing delivery experience as a consultant with a services firm, VAR, systems integrator, MSSP, or vendor professional services team, or an equivalent internal role delivering to multiple business units
• Linux administration and networking fundamentals (syslog over TCP/UDP/TLS, load balancing, firewalls), plus logging services in at least one cloud (AWS, Azure, or GCP)
• Scripting and data skills: JavaScript, Python, or Bash; regular expressions; REST APIs; JSON, key-value, CSV, and XML formats
• Ability to engage senior leadership and translate technical work into business terms, tying recommendations to the customer’s measurable goals rather than to the technical components alone, in writing and in person
• Cribl Certified User and Cribl Certified Admin (Stream), held at hire or earned within 90 days
• Embraces emerging technologies, including AI tools, to work smarter, solve problems, and drive better business outcomes.

Preferred Experience and Education

• Experience at a VAR, systems integrator, or MSSP working within vendor partner programs (partner certifications, joint delivery, supporting account teams on deals)
• Technical writing experience: assessment reports, executive summaries, architecture and as-built documents, and roadmaps written for both technical and executive readers (writing samples welcome)
• Delivery experience on more than one pipeline platform, with the judgment to recommend the right tool for the client
• Cribl Certified Admin (Edge); Splunk Certified Admin or Architect; Elastic Certified Engineer; SentinelOne AI Data Pipelines; cloud certifications (AWS, Azure, GCP)
• Kubernetes and containers; Terraform or Ansible; Git and CI/CD for pipeline configuration as code
• Kafka, object storage and data lakes (Amazon S3, Azure Blob, Cribl Lake), and Snowflake or Databricks as destinations
• OpenTelemetry for metrics and traces, and IT observability use cases alongside security
• Familiarity with MITRE ATT&CK data sources and what detection engineers need from the data
• Regulated or federal environments (HIPAA, PCI DSS, FedRAMP, CMMC, FIPS); ability to obtain a U.S. security clearance is a plus

Travel Requirements:

• Up to 15% travel

Physical Requirements:

• Sedentary work
• Substantial movement of the wrists, hands, and/or fingers for a minimum of 8 hours a day
• Required to have close visual acuity to view computer terminal and/or extensive reading for a minimum of 8 hours a day

Note: Applicants must be authorized to work for any employer in the U.S. We are unable to sponsor or take over sponsorship of an employment visa for this role.