Key areas of focus include
Establishing reliable and reusable data pipelines.
Improving data quality, accessibility, and processing efficiency.
Supporting security, observability, analytics, and operational use cases.
Roles and Responsibilities
Architect, deploy, and optimize telemetry pipelines with Cribl Stream, Edge, Lake, and Search, and with comparable platforms such as SentinelOne AI Data Pipelines (Observo AI), CrowdStrike Onum, Palo Alto Networks Chronosphere, Datadog Observability Pipelines (Vector), Splunk Edge Processor, and the OpenTelemetry Collector
Onboard, parse, and normalize data from syslog, agents, cloud provider logs, SaaS APIs, identity (Microsoft Entra ID, Okta), EDR, and network sources into common schemas (OCSF, Splunk CIM, Elastic ECS, Google UDM)
Build reduction, filtering, enrichment, and tiering strategies that send only high value data to premium analytics platforms, keep full fidelity copies in low cost storage, and support replay on demand
Quantify the business cases of baseline ingest, model savings, and present before and after results to technical and financial stakeholders
Brief client senior leadership (CISO, CIO, CFO) on findings, progress, and recommendations, framed around the customer’s measured business goals (cost avoided, coverage gained, risk reduced, time to investigate) rather than the technical components alone
Size and harden deployments, including worker topology, high availability and disaster recovery, queuing and backpressure, and fleet health monitoring, across on-premises, cloud, hybrid, and regulated environments
Build governance into the data flow with masking and redaction of sensitive data, role-based access control, TLS/PKI, and retention policy
Lead the data workstream of SIEM and platform migrations (for example Splunk, Elastic, Microsoft Sentinel, Google SecOps, CrowdStrike Falcon Next-Gen SIEM, SentinelOne AI SIEM)
Deliver pipeline health checks and optimization assessments with prioritized, actionable roadmaps
Support pre-sales by joining scoping calls with Solutions Architects and account teams, estimate level of effort, and contribute to statements of work
Work with vendor partner engineering teams on joint delivery, escalations, and product feedback and maintain current partner certifications
Work alongside Detection & Response and Automation & AI engineers to establish clean and well routed data to help make detection content, automation, and AI SOC agents more effective for our customers.
Serve as the technical point of contact on engagements, with clear progress reporting, as-built documentation, runbooks, and knowledge transfer to client teams
Contribute to practice intellectual property, including reusable packs, delivery playbooks, and effort baselines, and mentor other engineers
Required Experience and Education
5+ years in cybersecurity, IT operations, or data engineering, including 3+ years building and running production telemetry pipelines
Hands-on production experience with Cribl Stream or a comparable pipeline platform
Working knowledge of at least one SIEM or analytics destination (Splunk, Elastic, Microsoft Sentinel, Google SecOps, CrowdStrike, or SentinelOne), enough to know what the data must look like when it arrives
Client-facing delivery experience as a consultant with a services firm, VAR, systems integrator, MSSP, or vendor professional services team, or an equivalent internal role delivering to multiple business units
Linux administration and networking fundamentals (syslog over TCP/UDP/TLS, load balancing, firewalls), plus logging services in at least one cloud (AWS, Azure, or GCP)
Scripting and data skills: JavaScript, Python, or Bash; regular expressions; REST APIs; JSON, key-value, CSV, and XML formats
Ability to engage senior leadership and translate technical work into business terms, tying recommendations to the customer’s measurable goals rather than to the technical components alone, in writing and in person
Cribl Certified User and Cribl Certified Admin (Stream), held at hire or earned within 90 days
Embraces emerging technologies, including AI tools, to work smarter, solve problems, and drive better business outcomes.
Preferred Experience and Education
Experience at a VAR, systems integrator, or MSSP working within vendor partner programs (partner certifications, joint delivery, supporting account teams on deals)
Technical writing experience: assessment reports, executive summaries, architecture and as-built documents, and roadmaps written for both technical and executive readers (writing samples welcome)
Delivery experience on more than one pipeline platform, with the judgment to recommend the right tool for the client
Cribl Certified Admin (Edge); Splunk Certified Admin or Architect; Elastic Certified Engineer; SentinelOne AI Data Pipelines; cloud certifications (AWS, Azure, GCP)
Kubernetes and containers; Terraform or Ansible; Git and CI/CD for pipeline configuration as code
Kafka, object storage and data lakes (Amazon S3, Azure Blob, Cribl Lake), and Snowflake or Databricks as destinations
OpenTelemetry for metrics and traces, and IT observability use cases alongside security
Familiarity with MITRE ATT&CK data sources and what detection engineers need from the data
Regulated or federal environments (HIPAA, PCI DSS, FedRAMP, CMMC, FIPS); ability to obtain a U.S. security clearance is a plus
Travel Requirements
Up to 15% travel
Physical Requirements
Sedentary work
Substantial movement of the wrists, hands, and/or fingers for a minimum of 8 hours a day
Required to have close visual acuity to view computer terminal and/or extensive reading for a minimum of 8 hours a day
Note: Applicants must be authorized to work for any employer in the U.S. We are unable to sponsor or take over sponsorship of an employment visa for this role.
We use Greenhouse Software as our applicant tracking system and Zoom Scheduler for HR screen request scheduling. At times, your email may block our communication with you. Please be sure to check your SPAM folder so that you don't miss updates on your application.
Why GuidePoint?
GuidePoint Security is a rapidly growing, profitable, privately-held value added reseller that focuses exclusively on Information Security. Since its inception in 2011, GuidePoint has grown to over 1,300 employees, established strategic partnerships with leading security vendors, and serves as a trusted advisor to more than 6,200 customers.
Firmly-defined core values drive all aspects of the business, which have been paramount to the company’s success and establishment of an enjoyable workplace atmosphere. At GuidePoint, your colleagues are knowledgeable, skilled, and experienced and will seek to collaborate and provide mentorship and guidance at every opportunity.
This is a unique and rare opportunity to grow your career along with one of the fastest growing companies in the nation.
Some added perks….
Remote workforce primarily (U.S. based only, some travel may be required for certain positions, working on-site may be required for Federal positions)
Group Medical Insurance options: Zero Deductible PPO Plan (GuidePoint pays 90% of the premium for employees and 70% for family plans (spouse/children/family) or High Deductible Health Plan with HSA (GuidePoint pays 100% of the employees premiums and 75% for family plans (spouse/children/family). If you choose the High Deductible / HSA plan, GPS will contribute in 4 equal quarterly installments: ($850 per EE annually / $1750 per family annually (includes spouse/children/family options)
Group Dental Insurance: GuidePoint pays 100% of the premium for employees and 75% of family plans
12 corporate holidays and a Flexible Time Off (FTO) program
Healthy mobile phone and home internet allowance
Eligibility for retirement plan after 2 months at open enrollment
Pet Benefit Option
