{"id":1563979,"url":"https://alion.io/job/citi-data-platform-engineer-cybersecurity-operations","title":"Data Platform Engineer, Cybersecurity Operations","company":{"id":7841,"name":"Citi","domain":"citi.com","url":"https://alion.io/company/citi","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":100,"open_postings":335,"ghost_share":0.009,"stale_share":0.003,"repost_share":0.099,"time_to_fill_p50_days":10,"computed_at":"2026-10-07T05:47:15Z"}},"role":"Data Science","role_family":"Data Science","seniority":"staff","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Irving, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":156160,"max":234240,"currency":"USD","period":"year","gross":null,"usd_annual":234240},"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Amazon Redshift","optional":false},{"name":"Apache Kafka","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"BigQuery","optional":false},{"name":"CI/CD","optional":false},{"name":"Delta Lake","optional":false},{"name":"Flink","optional":false},{"name":"GCP","optional":false},{"name":"Google BigQuery","optional":false},{"name":"Java","optional":false},{"name":"Platform Engineering","optional":false},{"name":"Python","optional":false},{"name":"Scala","optional":false},{"name":"Self-Healing","optional":false},{"name":"SIEM","optional":false},{"name":"Snowflake","optional":false},{"name":"Spark","optional":false},{"name":"Time Series Forecasting","optional":false},{"name":"Feature Store","optional":true}],"status":"live","first_seen_at":"2026-09-29T00:00:00Z","employer_posted_date":"2026-09-29","last_verified_at":"2026-10-08T01:41:04Z","board_verified":true,"closed_at":null,"days_open":9,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":9},"description":"About the Role\nWe are seeking a Data Platform Engineer with deep, specialized expertise in data platform architecture and engineering to build and operate the scalable data pipelines, storage backbones, and data lakes that power our next-generation cybersecurity operations capabilities. This role sits at the foundation of our security analytics capability, ingesting and normalizing massive volumes of SOC telemetry into modern, high-performance analytics platforms.\nThis is a deep technical architecture and platform engineering role. We are looking for someone who has genuinely mastered the craft of designing, scaling, and operating enterprise-grade data platforms - not a generalist engineer, but a specialist capable of making foundational architectural decisions that will shape how security data is stored, queried, and consumed for years to come.\nKey Responsibilities\n Pipeline Engineering: Design, build, and operate scalable, resilient, high-throughput data pipelines (batch and streaming) that ingest security relevant telemetry - logs, alerts, network flow data, endpoint events, identity signals, and cloud events - from across the enterprise.\nData Normalization: Develop robust normalization and enrichment logic to transform heterogeneous SOC telemetry formats into standardized schemas consumable by downstream analytics and detection platforms.\n Storage Backbone Architecture: Architect and maintain the storage backbone (data lakes, warehouses, streaming stores) that serves as the durable, queryable source of truth for SOC data at enterprise scale.\nData Lake Operations: Build and operate data lake infrastructure optimized for high-volume security telemetry, balancing cost, performance, retention, and query flexibility.\nIntegration with Analytics Platforms: Ensure seamless, low-latency delivery of normalized SOC data into modern analytics platforms, SIEM/XDR tooling, and other downstream systems.\nScalability & Performance Engineering: Continuously tune pipeline throughput, storage partitioning, and query performance to keep pace with growing telemetry volume and evolving analytics demands.\nReliability & Observability: Implement monitoring, alerting, and self-healing capabilities to ensure pipeline uptime, data completeness, and data quality at production scale.\nSchema & Taxonomy Governance: Define and enforce data schemas, taxonomies, and metadata standards across ingested telemetry sources to enable consistent downstream consumption.\nAutomation of Onboarding: Build reusable frameworks and automation to rapidly onboard new telemetry sources as the tool and sensor ecosystem expands.\n Security & Compliance: Ensure secure handling, encryption, access control, and regulatory compliance for sensitive security data throughout its lifecycle (ingestion, storage, processing, access).\nCross-Functional Collaboration: Partner closely with cybersecurity operations analysts, detection engineers, threat and exposure management teams, and data science teams to ensure the platform meets operational and analytical needs.\nDocumentation & Knowledge Transfer: Maintain clear architecture documentation, data dictionaries, and operational runbooks to support platform sustainability and team scalability.\n\nRequired Skills & Experience\nDeep, demonstrable expertise in data platform architecture and engineering - a proven track record of architecting and operating large-scale, mission-critical data platforms from the ground up, with strong judgment on trade-offs across scalability, cost, performance, and reliability.\nExtensive, hands-on experience building and operating large-scale data pipelines (batch and streaming) using technologies such as Cribl, Kafka, Spark, Flink, Airflow, or equivalent.\nDeep expertise in data lake and data warehouse architecture (e.g., Delta Lake, Iceberg, Snowflake, BigQuery, Redshift) at enterprise scale, including experience making foundational design decisions on storage formats, partitioning strategies, and query engines.\nProven, in-depth experience with cloud-native data infrastructure (AWS/Azure/GCP), including storage tiering, cost optimization, and event-driven architectures.\nStrong understanding of security telemetry types - logs, network flow, endpoint/EDR data, identity events, cloud audit logs - and the architectural challenges of ingesting and normalizing them at scale.\nAdvanced proficiency in a major programming language (Python, Go, Java, or Scala) for pipeline development and automation.\nDeep experience with schema design, data modeling, and metadata management for large, heterogeneous, high-velocity datasets.\nSolid grounding in cybersecurity fundamentals, particularly SOC/OSVM operations, log management, and detection/analytics use cases.\nExtensive experience with database technologies spanning relational, NoSQL, time-series, and columnar/analytical stores.\nStrong software engineering fundamentals: CI/CD, infrastructure-as-code, version control, automated testing, and observability/monitoring practices.\nDemonstrated ability to architect for scale and reliability in mission-critical, 24x7 operational environments.\nExcellent cross-functional collaboration skills, able to work with security operations, detection engineering, and data science teams.\nPreferred Qualifications\n10+ years of experience in architecting data platforms specifically for SOC, SIEM, or XDR environments.\nFamiliarity with AI/ML pipeline requirements (feature stores, training data pipelines) to support advanced security analytics.\nDeep experience with open table formats (Iceberg, Delta Lake, Hudi) and modern lakehouse architectures.\nRelevant certifications (e.g., cloud data engineering certifications, GIAC) are a plus but not required in lieu of hands-on expertise.\nWhat We're Looking For\nA platform architect and builder at heart - someone who has spent their career deep in data platform engineering and wants to apply that expertise to one of the highest-stakes data domains in the enterprise: security telemetry at scale. You should be equally comfortable leading architectural / system design discussions and rolling up your sleeves to build and operate production systems.\nEducation:\nBachelor's degree/University degree or equivalent experience\nMaster's degree preferred\nThis job description provides a high-level review of the types of work performed. Other job-related duties may be assigned as required.\n------------------------------------------------------\nJob Family Group:\nTechnology------------------------------------------------------\nJob Family:\nInfrastructure------------------------------------------------------\nTime Type:\nFull time------------------------------------------------------\nPrimary Location:\nIrving Texas United States------------------------------------------------------\nPrimary Location Full Time Salary Range:\n$156,160.00 - $234,240.00In addition to salary, Citi’s offerings may also include, for eligible employees, discretionary and formulaic incentive and retention awards. Citi offers competitive employee benefits, including: medical, dental & vision coverage; 401(k); life, accident, and disability insurance; and wellness programs. Citi also offers paid time off packages, including planned time off (vacation), unplanned time off (sick leave), and paid holidays. For additional information regarding Citi employee benefits, please visit citibenefits.com. Available offerings may vary by jurisdiction, job level, and date of hire.\n------------------------------------------------------\nMost Relevant Skills\nPlease see the requirements listed above.------------------------------------------------------\nOther Relevant Skills\nFor complementary skills, please see above and/or contact the recruiter.------------------------------------------------------\nAnticipated Posting Close Date:\nOct 25, 2026------------------------------------------------------\nAutomated Processing and AI\nWe use automated processing, including artificial intelligence, for our legitimate business interests (or our reasonable and appropriate business purposes) to identify and align the candidate's skills and abilities with a specific job opening. Additionally, if you so choose, or consent, we can match your skills and abilities to other suitable roles at Citi.\nImportantly, all our hiring processes and decisions, including determining your suitability for a role, are conducted, checked, and decided by individuals. Our automated processing and AI do not involve relying on automatic or autonomous decision-making. Please refer to any Jurisdictional Considerations, with specific provisions for your country (where relevant) for further details.\nIllinois residents - AI Notice and Right\n------------------------------------------------------\nCiti is an equal opportunity employer, and qualified candidates will receive consideration without regard to their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, status as a protected veteran, or any other characteristic protected by law.\nIf you are a person with a disability and need a reasonable accommodation to use our search tools and/or apply for a career opportunity review Accessibility at Citi.\nView Citi’s EEO Policy Statement and the Know Your Rights poster.","description_format":"text","description_chars":9266,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Wellness"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Financial Services","Incident Response"],"lifecycle":[{"event":"open","at":"2026-10-01T05:30:31Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"Filed H-1B visas in the last two years","filings_12m":0,"filings_prev_12m":1,"green_card_filings_12m":0,"median_offered_wage_usd":null,"route":null,"cap_exempt":false,"checked_at":"2026-10-03T21:08:04+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":60,"band":"ok","label":"Likely open","p_open":1,"p_active":0.794,"p_room":0.75,"age_days":8,"expected_fill_days":10,"reasons":["conf:1","velocity","win:late","comp:brand"],"computed_at":"2026-10-07T05:47:15Z"},"pay":{"stated_usd_annual":234240,"is_top_pay":true},"html_url":"https://alion.io/job/citi-data-platform-engineer-cybersecurity-operations","json_url":"https://alion.io/job/citi-data-platform-engineer-cybersecurity-operations.json","meta":{"generated_at":"2026-10-08T02:29:42Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler","counted_by":"address","units_charged":1,"used_today":4316,"day_limit":5000,"remaining_today":684,"minute_limit":60,"resets_at":"2026-10-09T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":7841},"rest":"https://alion.io/mcp/rest/get_company?id=7841"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fciti-data-platform-engineer-cybersecurity-operations"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fciti-data-platform-engineer-cybersecurity-operations"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fciti-data-platform-engineer-cybersecurity-operations"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/citi-data-platform-engineer-cybersecurity-operations\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fciti-data-platform-engineer-cybersecurity-operations"}]}