Security Data Engineer

Join Deloitte’s Enterprise Security team in Colorado Springs to help clients design, implement, and improve enterprise security solutions.

Responsibilities

• Design, write, and deploy high-fidelity detection rules using SQL, Sigma, YARA-L, or Python for network-based attack techniques (including C2 beaconing, data exfiltration, and lateral movement).
• Continuously tune network detections to reduce false positives while keeping strong signal-to-noise.
• Determine the telemetry needed for network monitoring, threat hunting, incident response, and custom detection engineering.
• Translate detection needs into data-source requirements and identify visibility gaps across hybrid cloud and on-premises environments.
• Design and maintain ingestion pipelines for security telemetry from network, endpoint, identity, cloud, application, OT, and security infrastructure.
• Ensure reliable delivery of telemetry to SIEM, data lake, analytics, and detection platforms; troubleshoot ingestion, parsing, latency, and data-quality issues.
• Validate whether telemetry types (packet, flow, session, DNS, proxy, authentication, endpoint, application) are sufficient for specific detection requirements.
• Support custom detection engineering through data discovery, enrichment, normalization, and validation.
• Use the Detection Stack to identify opportunities to elevate detections from low-level indicators to higher-level behavioral and tradecraft-based detection.
• Collaborate with network engineering teams to evaluate telemetry and detection-related technologies, including network sensors, NetFlow/IPFIX, DNS telemetry, proxy telemetry, firewall logs, IDS/IPS, packet capture, Zeek (network metadata), and NDR platforms.
• Establish telemetry health metrics, dashboards, and automated checks for missing, delayed, or malformed data.
• Assess network visibility across data centers, cloud environments, remote networks, and segmented environments.
• Optimize telemetry architectures and ingestion pipelines for performance, scalability, reliability, and cost.

Requirements

• Bachelor’s degree in Cybersecurity or Information Technology.
• Active TS/SCI or SCI eligibility.
• 4+ years of experience in cybersecurity, enterprise security, or information security.
• 3+ years supporting the implementation or administration of security technologies across enterprise environments.
• 3+ years producing technical documentation, status reporting, or client deliverables for security engagements.

Technologies

• SQL
• Sigma
• YARA-L
• Python
• SIEM
• Detection Stack
• NetFlow/IPFIX
• IDS/IPS
• Zeek
• NDR
• Packet capture

Benefits

• Eligible for a benefits package that is competitive for project delivery-focused professionals.
• May be eligible to participate in a discretionary annual incentive program, subject to program rules.

Preferred

• Master’s degree in Cybersecurity, Information Technology, Information Systems, Engineering or related field with 10+ years of related experience.
• Experience supporting government or public sector clients.
• Experience with cloud security, data security, and network security.

Location: Colorado Springs, CO (onsite)

Salary: USD 95,600 - 159,300 per year