Senior Security Engineer – Data Pipeline & Observability - Mid-Atlantic region (Remote)

GuidePoint Security provides trusted cybersecurity expertise, solutions and services that help organizations make better decisions and minimize risk. By taking a three-tiered, holistic approach for evaluating security posture and ecosystems, GuidePoint enables some of the nation’s top organizations, such as Fortune 500 companies and U.S. government agencies, to identify threats, optimize resources and integrate best-fit solutions that mitigate risk.

General Description

GuidePoint is both a Value-Added Reseller (VAR) and a professional services organization, and an award winning Cribl partner (Cribl Americas Solution Provider Partner of the Year, 2026). In this role you will work directly with our vendor partners and account teams, see the same problems across many client environments, and keep up with a market that is changing quickly.

Security data is growing faster than security budgets. Clients come to us because their SIEM bill is out of control, their data is inconsistent, or they are moving platforms and need the data to arrive clean. You will design and build the pipelines that fix those problems, and you will explain the cost and security trade-offs to the people who pay for them

About our Mid-Atlantic SecOps practice

Our team of data engineers, SecOps engineers, consultants, architects, and platform specialists focuses on data integration, normalization, quality, routing, retention, and platform optimization. We partner with clients, account executives, project managers, source-system owners, security teams, and technology providers to create supportable data services.

Key areas of focus include:

• Establishing reliable and reusable data pipelines.
• Improving data quality, accessibility, and processing efficiency.
• Supporting security, observability, analytics, and operational use cases.

Roles and Responsibilities

• Architect, deploy, and optimize telemetry pipelines with Cribl Stream, Edge, Lake, and Search, and with comparable platforms such as SentinelOne AI Data Pipelines (Observo AI), CrowdStrike Onum, Palo Alto Networks Chronosphere, Datadog Observability Pipelines (Vector), Splunk Edge Processor, and the OpenTelemetry Collector
• Onboard, parse, and normalize data from syslog, agents, cloud provider logs, SaaS APIs, identity (Microsoft Entra ID, Okta), EDR, and network sources into common schemas (OCSF, Splunk CIM, Elastic ECS, Google UDM)
• Build reduction, filtering, enrichment, and tiering strategies that send only high value data to premium analytics platforms, keep full fidelity copies in low cost storage, and support replay on demand
• Quantify the business cases of baseline ingest, model savings, and present before and after results to technical and financial stakeholders
• Brief client senior leadership (CISO, CIO, CFO) on findings, progress, and recommendations, framed around the customer’s measured business goals (cost avoided, coverage gained, risk reduced, time to investigate) rather than the technical components alone
• Size and harden deployments, including worker topology, high availability and disaster recovery, queuing and backpressure, and fleet health monitoring, across on-premises, cloud, hybrid, and regulated environments
• Build governance into the data flow with masking and redaction of sensitive data, role-based access control, TLS/PKI, and retention policy
• Lead the data workstream of SIEM and platform migrations (for example Splunk, Elastic, Microsoft Sentinel, Google SecOps, CrowdStrike Falcon Next-Gen SIEM, SentinelOne AI SIEM)
• Deliver pipeline health checks and optimization assessments with prioritized, actionable roadmaps
• Support pre-sales by joining scoping calls with Solutions Architects and account teams, estimate level of effort, and contribute to statements of work
• Work with vendor partner engineering teams on joint delivery, escalations, and product feedback and maintain current partner certifications
• Work alongside Detection & Response and Automation & AI engineers to establish clean and well routed data to help make detection content, automation, and AI SOC agents more effective for our customers.