Troubleshooting & Recovery: Investigate API token expirations, network timeouts, and log schema drift. Utilize monitoring tools (such as Cribl Vision) for proactive drop-off detection and rapid incident recovery.
Secondary Focus: Security Data Fabric & Infrastructure Integration
Security Data Fabric Automation: Assist in connecting security telemetry between platforms (Imperva WAF, Zscaler, Firewalls, and SIEM) to automate the sharing of malicious IP/URL indicators and threat intelligence.
Cloud Log Architecture Optimization: Collaborate with cloud architects to streamline Azure log collection (e.g., regional Event Hub deployments), reducing redundant workspace storage costs.
Cross-Team Collaboration: Partner with SOC, Cloud Engineering, Network Security, and GRC teams to ensure high data quality, clear log ownership, and audit-compliant log retention.
What we look for
Required Skills (Must-Haves)
Hands-on operational experience with Cribl Stream (Routes, Pipelines, Functions, Event Breakers, Worker Groups) or equivalent log pipeline technologies (Logstash, Vector, Fluentd).
Experience working with enterprise SIEM or Log Analytics platforms (CrowdStrike NextGen SIEM / Humio, Azure Log Analytics, or Splunk).
Solid understanding of common log sources and formats (Syslog, JSON, CEF/LEEF, Windows Event Logs, Cloud Audit Logs, NetFlow).
Practical experience with cloud logging infrastructure (Azure Event Hubs, Storage Accounts, or AWS S3/CloudWatch) and REST API data ingestion.
Basic scripting and automation skills in Python, PowerShell, or Bash for API calls and log parsing.
Strong troubleshooting mindset and ITIL operational experience (Incident, Change, and Problem Management via ServiceNow/Jira).
Desirable Skills (Nice-to-Haves)
Cribl Stream Certification (Cribl Certified Admin or User) or CrowdStrike Falcon LogScale / NextGen SIEM certifications.
Understanding of Log Common Information Models (CIM) and schema mapping standards.
Exposure to Security Data Fabric, Threat Intelligence feeds, or automated SOAR workflows.
Familiarity with ServiceNow CMDB, Jira tracking, and building basic operational dashboards.
Johnson Controls International plc. is an equal employment opportunity and affirmative action employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, protected veteran status, genetic information, status as a qualified individual with a disability, or any other characteristic protected by law. For more information, please view EEO is the Law. If you are an individual with a disability and you require an accommodation during the application process, please visit www.johnsoncontrols.com/careers.
