{"id":182562,"url":"https://alion.io/job/state-street-senior-siem-data-engineer","title":"Senior SIEM Data Engineer","company":{"id":1806,"name":"State Street","domain":"statestreet.com","url":"https://alion.io/company/state-street","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":97,"open_postings":338,"ghost_share":0.015,"stale_share":0.24,"repost_share":0.047,"time_to_fill_p50_days":21,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Data Science","role_family":"Data Science","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Quincy, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":120000,"max":202500,"currency":"USD","period":"year","gross":null,"usd_annual":202500},"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Amazon ECS","optional":false},{"name":"CI/CD","optional":false},{"name":"Databricks","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Apache Kafka","optional":true},{"name":"Fluent Bit","optional":true},{"name":"Fluentd","optional":true},{"name":"Incident Management","optional":true},{"name":"Platform Engineering","optional":true},{"name":"PowerShell","optional":true},{"name":"pySpark","optional":true},{"name":"Python","optional":true},{"name":"Rest API","optional":true},{"name":"Spark","optional":true},{"name":"SQL","optional":true},{"name":"Vector","optional":true}],"status":"live","first_seen_at":"2026-08-31T00:00:00Z","employer_posted_date":"2026-09-14","last_verified_at":"2026-10-17T02:12:17Z","board_verified":true,"closed_at":null,"days_open":47,"trust":{"level":"ok","repost_count":1,"flags":[],"days_open":47},"description":"Who we are looking for\nWe are lookingfor aSenior SIEM Data Engineerreporting directly to theCyber Data Engineering Manager. You will lead the design, onboarding, transformation, validation, and operational support of cybersecurity telemetry and enterprise log data used for security monitoring, analytics, reporting, incident response, and cyber data science use cases.\nThis role is focused on understanding diverse enterprise data sources, designing scalable security telemetry pipelines, improving log fidelity and data quality, and ensuring reliable delivery of high-value data into cyber data platforms such as Splunk, Databricks, and other SIEM or cyber analytics platforms. You will work closely with cybersecurity, infrastructure, cloud, application, and data engineering teams to ensure security telemetry isaccurate, complete, searchable, governed, and fit for purpose. As a senior engineer, you will also help define onboarding standards, mentor engineers, drive operational maturity, support complex troubleshooting, and contribute to the evolution of enterprise cyber data engineering capabilities.\nWhy This Role Is Important to Us\nThe team you will be joining is part of Cyber Data & Analytics, a function that is vital to the company as it enables cybersecurity teams to make faster, data-driven decisions and strengthen the firm’s ability to detect, investigate, and respond to evolving cyber threats.\nHigh-quality cybersecurity data is foundational to effective threat detection, incident response, risk reporting, observability, automation, analytics, and compliance. This role helps ensure that enterprise security telemetry is properly onboarded,validated, enriched, routed,monitored, and continuously available to support critical cyber defense capabilities.\nWhat you will be responsible for\nAs SeniorSIEM Data Engineer you will:\nDesign, build, andmaintainscalable SIEM and security telemetry pipelines across hybrid and multi-cloud environments.\n\nLead onboarding of security telemetry from applications, infrastructure, endpoints, identity platforms, network devices, cloud services, SaaS tools, databases, and security products.\n\nAnalyze source log formats and define onboarding requirements, expected fields, metadata, routing needs, retention considerations, and downstream SIEM/analytics use cases.\n\nBuild andoptimizetelemetry pipelines for parsing, filtering, masking, enrichment, normalization, event breaking, metadata tagging, and multi-destination routing.\n\nDeliver reliable security telemetry toSplunk, Databricks, and other SIEM or cyber analytics platforms.\n\nDesign and support Databricks data engineering patterns across raw, enriched, curated, and analytics-ready data layers.\n\nValidate data quality across cyber data platforms for freshness, completeness, correctness, availability, timestamp accuracy, schema consistency, source attribution, routing accuracy, and latency.\n\nEstablish SIEM onboarding standards for source classification, source types, index routing, taxonomy alignment, metadata tagging, schema expectations, CIM/ECS alignment, and data quality controls.\n\nOptimizetelemetry pipelines to reduce noise, control ingestion cost, improve performance, and preserve high-value security data for detection and investigation.\n\nLead troubleshooting of complex ingestion and data flow issues across sources, collectors, pipelines, SIEM platforms, Databricks tables, APIs, cloud storage, and streaming platforms.\n\nProvidesecond-line-of-defense support, escalation, and root cause analysisfor operational issues related to data engineering jobs, pipelines, ingestion failures, and issues leading to loss of data delivery to cyber data platforms.\n\nAutomate deployment, monitoring, alerting, validation, pipeline testing, repeatable onboarding, and operational support using CI/CD and infrastructure-as-code practices.\n\nPartner with Detection Engineering, Security Operations, Cyber Data Science, Observability, Cloud, Infrastructure, Application, Governance, Risk, and Platform teams to ensure telemetry supports business and security use cases.\n\nCreate andmaintainonboarding standards, data flow diagrams, field mappings, transformation logic, runbooks, troubleshooting procedures, operational handoffs, and engineering documentation.\n\nMentor engineers and promote best practices for security telemetry onboarding, data quality, automation, reliability, operational excellence, and secure engineering.\n\nWhat we value\nThese skills will help you succeed in this role\nStrong experience with SIEM data onboarding, security telemetry pipelines, log ingestion, routing, parsing, enrichment, validation, and troubleshooting.\n\nStrong hands-on experience withSplunkor similar SIEM/log analytics platforms.\n\nHands-on experience withCribl Streamor similar data pipeline technologies for routing, filtering, parsing, enrichment, transformation, event breaking, replay, and multi-destination delivery.\n\nAbility to understand and onboard telemetry from diverse enterprise data sources across cloud, endpoint, identity, network, application, infrastructure, database, SaaS, and security platforms.\n\nWorking knowledge of Databricks or similar analytics/lakehouseplatforms, including raw ingestion, enrichment, curated datasets, table design, partitioning, data quality checks, and analytics-ready outputs.\n\nStrong understanding of data quality concepts, including log fidelity, freshness, completeness, correctness, availability, schema consistency, duplicate detection, routing validation, and ingestion latency.\n\nStrong understanding of data engineering concepts such as data layers, schema design, metadata management, transformation, enrichment, deduplication, batch/streaming ingestion, and pipeline monitoring.\n\nPractical knowledge of SIEM taxonomy, source classification, security use case mapping, CIM/ECS alignment, schema mapping, and enterprise log onboarding standards.\n\nStrong understanding of DevOps,DataOps,DevSecOps, CI/CD, infrastructure-as-code, automation, and production support practices.\n\nStrong troubleshooting, documentation, communication, stakeholder management, prioritization, mentoring, and end-to-end ownership skills.\n\nEducation & Preferred Qualifications\nMaster's or bachelor'sdegree in computer science, Cybersecurity, Information Technology, Engineering, Data Engineering, Data Analytics, Information Systems, or a related technical field; equivalent work experience may also be considered.\n\n8+ years of experiencein SIEM engineering, cybersecurity data engineering, security platform engineering, log analytics, telemetry operations, or large-scale log onboarding, with strong hands-on experience usingSplunk or similar SIEM/log analytics platforms.\n\nProven experience designing, onboarding,validating, and troubleshooting security telemetry from diverse enterprise sources to supportthreat detection, observability, incident response, reporting, cyber analytics, and data scienceuse cases.\n\n3+ years of experiencewithCribl Streamor similar data pipeline technologies such as Fluent Bit/Fluentd, Vector, Kafka,Syslog, HEC, REST APIs, cloud-native ingestion services, or streaming platforms.\n\n2+ years of experiencewithDatabricks, datalakehouseplatforms, large-scale analytics platforms, or security data repositories for telemetry validation, analytics, and data engineering use cases.\n\nExperience querying,validating, and transforming data usingSPL, SQL, Spark SQL, Python,PySpark, Shell, PowerShell, or similar languages.\n\nExperience with cloud-native security telemetry and ingestion patterns across hybrid or multi-cloud environments.\n\nExperience with production support, issue troubleshooting, incident management, change management, ticket documentation, root cause analysis, operational handoffs, vendor coordination, and continuous service improvement.\n\nExperience mentoring engineers, leading technical initiatives, conducting design reviews, defining onboarding standards, and driving engineering best practices.\n\nRelevant certifications are preferred, includingCribl certificationssuch asCribl Certified Observability Engineer,Splunk certificationssuch asSplunk Certified ArchitectorSplunk Certified Consultant, or equivalent hands-on platform engineering experience.\n\nCloud, infrastructure, data engineering, or cybersecurity certifications are a plus.\n\nWork Requirement\nThis role may follow a hybrid work model, with in-office presence requiredbased on team, business, and location expectations.\n\nStandard working hours are 8:00 AM to 5:00 PM local time for the employee’s designated work location. Flexibility may be requiredfor occasional operational support, release of activities, incident resolution, escalation support, or data delivery of recovery efforts.\n\nWhy this role is important to us\nOur technology function, Global Technology Services (GTS), is vital to State Street and is the key enabler for our business to deliver data and insights to our clients. We’redriving the company’s digital transformation and expanding business capabilities using industry best practices and advanced technologies such as cloud, artificial intelligenceand robotics process automation.\nWe offer a collaborative environment where technology skills and innovation are valued in a global organization. We’relooking for top technical talent to join our team and deliver creative technology solutions that help us become an end-to-end, next-generation financial services company.\nJoin us if you want to grow your technical skills, solve real problems and make your mark on our industry.\nAbout State Street\nWhat we do. State Street is one of the largest custodian banks, asset managersand asset intelligence companies in the world. From technology to product innovationwe’remaking our mark on the financial services industry. For more than two centuries, we’vebeen helping our clients safeguard and steward the investments of millions of people. We provide investment servicing, data & analytics, investment research & tradingand investment management to institutional clients.\nWork, Live and Grow. We make all efforts to create a great workenvironment. Our benefits packages are competitive and comprehensive. Details vary in locations, but you may expect generous medical care, insurance and savings plansamong other perks. You’llhave access to flexibleWork Program to help you match your needs. And our wealth of development programs and educational support will help you reach your full potential.\nInclusion, Diversityand Social Responsibility. We truly believeour employees’ diverse backgrounds, experiences and perspective are a powerful contributor to creating an inclusive environment where everyone can thrive and reach their maximum potential while adding value to both our organization and our clients. We warmly welcome the candidatesof diverse origin, background, ability, age, sexual orientation, gender identityand personality. Another fundamental value at State Street is active engagement with our communities around the world, both as a partner and a leader. You will have tools to help balance your professional and personal life, paid volunteer days, matching gift programand access to employee networks that help you stay connected to what matters to you.\nState Street is an equal opportunity and affirmative action employer.\nDiscover more at StateStreet.com/careers\nSalary Range:\n$120,000 - $202,500 AnnualThe range quoted above applies to the role in the primary location specified. If the candidate would ultimately work outside of the primary location above, the applicable range could differ.\nEmployees are eligible to participate in State Street’s comprehensive benefits program, which includes: our retirement savings plan (401K) with company match; insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages; paid-time off including vacation, sick leave, short term disability, and family care responsibilities; access to our Employee Assista...","description_format":"text","description_chars":13737,"description_truncated":true,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":false,"languages":[]},"benefits":["401k plan","Flexible schedule","Hybrid work","Insurance coverage","Retirement plans"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Security Operations","Asset Management & Funds","Custody & Fund Administration"],"lifecycle":[{"event":"open","at":"2026-09-01T04:02:11Z"},{"event":"close","at":"2026-09-11T14:29:48Z"},{"event":"reopen","at":"2026-09-14T14:58:58Z"}],"visa":[],"liveness":{"score":16,"band":"cold","label":"Long shot","p_open":1,"p_active":0.584,"p_room":0.28,"age_days":47,"expected_fill_days":21,"reasons":["conf:3","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-17T05:46:00Z"},"pay":{"stated_usd_annual":202500,"is_top_pay":true},"html_url":"https://alion.io/job/state-street-senior-siem-data-engineer","json_url":"https://alion.io/job/state-street-senior-siem-data-engineer.json","meta":{"generated_at":"2026-10-17T21:23:40Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6003,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1806},"rest":"https://alion.io/mcp/rest/get_company?id=1806"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fstate-street-senior-siem-data-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fstate-street-senior-siem-data-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fstate-street-senior-siem-data-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/state-street-senior-siem-data-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fstate-street-senior-siem-data-engineer"}]}