{"id":3056362,"url":"https://alion.io/job/johnson-controls-security-data-siem-engineer","title":"Security Data & SIEM Engineer","company":{"id":448321,"name":"Johnson Controls","domain":"johnsoncontrols.com","url":"https://alion.io/company/johnsoncontrols-3","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":83,"open_postings":520,"ghost_share":0,"stale_share":0.66,"repost_share":0.006,"time_to_fill_p50_days":33,"computed_at":"2026-10-28T05:59:10Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Dalian, China"],"countries":["CN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Amazon CloudWatch","optional":false},{"name":"Amazon S3","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Crowdstrike","optional":false},{"name":"FinOps","optional":false},{"name":"Fluentd","optional":false},{"name":"ITIL","optional":false},{"name":"Jira","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"ServiceNow","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Vector","optional":false},{"name":"Windows","optional":false},{"name":"Zero Trust","optional":false},{"name":"Zscaler","optional":false}],"status":"live","first_seen_at":"2026-10-22T04:00:24Z","employer_posted_date":"2026-10-22","last_verified_at":"2026-10-28T06:31:53Z","board_verified":true,"closed_at":null,"days_open":6,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":6},"description":"Job Code:\nTBD\nJob Code Name:\nSecurity Engineering - Technical Specialist\nBusiness Title:\nSecurity Data & SIEM Engineer (Cribl & SIEM)\nLocation:\nIndia / China\nWhat you will do:\nAs part of Johnson Controls’ Global Zero Trust & Security Analytics team, the Security Data & SIEM Engineer will be responsible for the day-to-day operation, management, and optimization of our enterprise security logging pipeline and SIEM platform. This role is heavily focused on Cribl Stream log stream processing, log parsing, and CrowdStrike NextGen SIEM data onboarding, with secondary focus on Global event routing and Security Data Fabric integration across enterprise security platforms.\nHow you will do it:\nPrimary Focus: Cribl Log Stream Engineering & SIEM Data Operations\nDaily Operations & Telemetry Health: Serve as the operational SME for the Cribl Stream pipeline and CrowdStrike NextGen SIEM environment. Conduct daily health checks, monitor log flow metrics, and resolve ingestion disruptions or collector errors.\n Log Ingestion, Parsing & Schema Normalization: Onboard new enterprise log sources (Firewalls, EDR, Web Proxies, Active Directory, Cloud logs). Create and maintain Cribl routes, pipelines, event breakers, and custom parsers to ensure standardized schema mapping.\n Log Cost Optimization & FinOps: Implement intelligent filtering, deduplication, and routing rules in Cribl Stream to strip unnecessary log noise, optimizing cloud storage (Azure Event Hubs) and SIEM license utilization.\n Troubleshooting & Recovery: Investigate API token expirations, network timeouts, and log schema drift. Utilize monitoring tools (such as Cribl Vision) for proactive drop-off detection and rapid incident recovery.\nSecondary Focus: Security Data Fabric & Infrastructure Integration\n Security Data Fabric Automation: Assist in connecting security telemetry between platforms (Imperva WAF, Zscaler, Firewalls, and SIEM) to automate the sharing of malicious IP/URL indicators and threat intelligence.\n Cloud Log Architecture Optimization: Collaborate with cloud architects to streamline Azure log collection (e.g., regional Event Hub deployments), reducing redundant workspace storage costs.\nCross-Team Collaboration: Partner with SOC, Cloud Engineering, Network Security, and GRC teams to ensure high data quality, clear log ownership, and audit-compliant log retention.\nWhat we look for:\nRequired Skills (Must-Haves):\nHands-on operational experience with Cribl Stream (Routes, Pipelines, Functions, Event Breakers, Worker Groups) or equivalent log pipeline technologies (Logstash, Vector, Fluentd).\nExperience working with enterprise SIEM or Log Analytics platforms (CrowdStrike NextGen SIEM / Humio, Azure Log Analytics, or Splunk).\nSolid understanding of common log sources and formats (Syslog, JSON, CEF/LEEF, Windows Event Logs, Cloud Audit Logs, NetFlow).\nPractical experience with cloud logging infrastructure (Azure Event Hubs, Storage Accounts, or AWS S3/CloudWatch) and REST API data ingestion.\nBasic scripting and automation skills in Python, PowerShell, or Bash for API calls and log parsing.\nStrong troubleshooting mindset and ITIL operational experience (Incident, Change, and Problem Management via ServiceNow/Jira).\nDesirable Skills (Nice-to-Haves):\nCribl Stream Certification (Cribl Certified Admin or User) or CrowdStrike Falcon LogScale / NextGen SIEM certifications.\nUnderstanding of Log Common Information Models (CIM) and schema mapping standards.\nExposure to Security Data Fabric, Threat Intelligence feeds, or automated SOAR workflows.\nFamiliarity with ServiceNow CMDB, Jira tracking, and building basic operational dashboards.\nJohnson Controls International plc. is an equal employment opportunity and affirmative action employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, protected veteran status, genetic information, status as a qualified individual with a disability, or any other characteristic protected by law. For more information, please view EEO is the Law. If you are an individual with a disability and you require an accommodation during the application process, please visit www.johnsoncontrols.com/careers.","description_format":"text","description_chars":4231,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"China","iso":"CN","kind":"country"},{"name":"India","iso":"IN","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Security Operations","HVAC & Refrigeration","Access Control & Alarm Systems","Building Automation & Controls"],"lifecycle":[{"event":"open","at":"2026-10-22T04:00:24Z"}],"visa":[],"liveness":{"score":62,"band":"ok","label":"Likely open","p_open":1,"p_active":0.619,"p_room":1,"age_days":6,"expected_fill_days":33,"reasons":["conf:5","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-10-28T05:59:10Z"},"pay":null,"html_url":"https://alion.io/job/johnson-controls-security-data-siem-engineer","json_url":"https://alion.io/job/johnson-controls-security-data-siem-engineer.json","meta":{"generated_at":"2026-10-28T07:40:34Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":9803,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-29T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":448321},"rest":"https://alion.io/mcp/rest/get_company?id=448321"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fjohnson-controls-security-data-siem-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fjohnson-controls-security-data-siem-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fjohnson-controls-security-data-siem-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/johnson-controls-security-data-siem-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fjohnson-controls-security-data-siem-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3056362}},{"tool":"search_jobs","arguments":{"company":"johnsoncontrols.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3056362},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}