Role description
Job Description: Security Data Engineer
Role Overview
The Security Data Engineer is responsible for designing, developing, and maintaining scalable data engineering solutions that enable advanced security analytics, reporting, and Continuous Threat Exposure Management (CTEM). This role ensures seamless ingestion, transformation, and enrichment of security telemetry into actionable insights that support Security Operations, Risk Management, and Executive decision-making.
The engineer will collaborate across SOC, security engineering, and compliance teams to deliver high-quality data pipelines, dashboards, and reporting frameworks that enhance visibility into the organization's security posture.
Key Responsibilities
1. Security Data Engineering
- Design and implement scalable data ingestion frameworks to collect security data from diverse sources, including:
- SIEM platforms
- Endpoint Detection & Response (EDR) tools
- Cloud environments (AWS, Azure, GCP)
- Vulnerability management solutions
- Governance, Risk, and Compliance (GRC) platforms
- External and internal APIs
- Develop and maintain robust ETL/ELT pipelines to:
- Transform raw security telemetry into structured, queryable datasets
- Normalize and standardize data across heterogeneous sources
- Support downstream analytics and reporting use cases
- Ensure high levels of data integrity and reliability through:
- Data normalization and deduplication
- Data enrichment (e.g., threat intelligence, asset context, CVSS scoring)
- Data validation and quality assurance checks
- Optimize data pipelines for performance, scalability, and cost efficiency in cloud and hybrid environments.
2. Security Analytics & Dashboards
- Design, develop, and maintain interactive Tableau dashboards for:
- Executive leadership (CISO, CIO, Risk Leaders)
- Security Operations Center (SOC) teams
- Engineering and remediation teams
- Define and implement security KPIs and metrics, including:
- Enterprise risk scores
- Vulnerability trends and exposure metrics
- Remediation SLA adherence
- Threat detection and response effectiveness
- Attack surface visibility and reduction
- Continuously enhance dashboards to:
- Improve usability and accessibility for stakeholders
- Ensure real-time or near-real-time insights
- Maintain performance and scalability
3. Reporting & Automation
- Design and implement automated reporting solutions to replace manual and spreadsheet-driven processes.
- Develop reusable reporting frameworks for:
- Security posture reporting
- Compliance reporting (internal and regulatory)
- Risk and audit reporting
- Generate:
- Scheduled (daily/weekly/monthly) reports
- On-demand and ad-hoc analysis for stakeholders
- Integrate reporting workflows with enterprise systems to enable seamless data delivery and consumption.
4. Business Context Integration & CTEM Support
- Integrate security datasets with enterprise business systems such as:
- ITSM / ticketing platforms (e.g., ServiceNow)
- Configuration Management Database (CMDB)
- Cloud asset inventories and business applications
- Provide contextualized insights by correlating:
- Technical vulnerabilities with business ownership
- Asset criticality with risk exposure
- Security events with operational impact
- Support Continuous Threat Exposure Management (CTEM) initiatives by:
- Mapping technical findings to business risk
- Prioritizing remediation based on impact and exploitability
- Enabling data-driven exposure reduction strategies
- Collaborate with cross-functional teams (SOC, Threat Intelligence, GRC, Engineering) to:
- Translate operational data into actionable intelligence
- Improve detection, response, and remediation workflows
Required Skills & Qualifications
- Strong experience in data engineering (ETL/ELT, data pipelines, data modeling)
- Proficiency in SQL, Python, or similar data processing languages
- Hands-on experience with SIEM platforms and security tools (EDR, vulnerability scanners, GRC tools)
- Experience with Tableau or similar BI/visualization tools
- Familiarity with cloud platforms (AWS, Azure, GCP) and data services
- Understanding of cybersecurity domains (SOC, threat detection, vulnerability management)
- Knowledge of data governance, quality, and security best practices
Deliverables - Security Data Engineer
The Security Data Engineer will be responsible for delivering the following:
- Security Analytics Dashboards:
- Interactive Tableau dashboards tailored to executive and operational stakeholders
- Automated Reporting Outputs:
- Scheduled and on-demand security and compliance reports
- Fully automated reporting workflows replacing manual processes
- Curated Security Datasets:
- Structured, normalized, and enriched datasets ready for analytics and consumption
- Documentation:
- Data architecture and data models
- Dashboard configurations and logic
- Reporting workflows and automation processes
Skills
data security,edr,cloud platform,data governance,
About UST
UST is a global digital transformation solutions provider. For more than 20 years, UST has worked side by side with the world’s best companies to make a real impact through transformation. Powered by technology, inspired by people and led by purpose, UST partners with their clients from design to operation. With deep domain expertise and a future-proof philosophy, UST embeds innovation and agility into their clients’ organizations. With over 30,000 employees in 30 countries, UST builds for boundless impact—touching billions of lives in the process.
