Security Tooling Engineer

Quick Facts

Hands-on engineering role to unify security telemetry (network, endpoint/EDR, identity, CI/CD) into a single detection and response capability.

Description

Own and administer a central log aggregation and detection platform that turns disparate security telemetry into a single, coherent detection and response capability. You will design ingestion pipelines, configure retention and alerting, and build extensible correlation rules that support new data sources over time.

Responsibilities

• Design and maintain a central log aggregation and detection platform (ingestion pipelines, retention/lifecycle, query/alert configuration).
• Integrate telemetry from EDR, network, identity, and CI/CD into one correlated view.
• Build and tune correlation rules and alerting logic to move beyond siloed dashboards.
• Maintain the data pipeline across shippers, aggregation, storage, and visualization.
• Investigate incidents that emerge from cross-source correlation.
• Incorporate CI/CD pipeline and supply-chain security signals into detections.
• Assess new tools/third-party platforms before integration, with focus on data handling and compliance.
• Keep the correlation/detection model extensible so new sources can be onboarded with minimal reengineering.
• Support incident response by directly interrogating log and event data.
• Maintain technical documentation suitable for handover and audit.
• Plan deployment integrations for an infrastructure-as-code environment.

Requirements

• 3+ years of hands-on experience with a log aggregation and detection platform (Elastic Stack, Splunk, Graylog, or comparable), including pipeline design, data management, and detection logic.
• Experience integrating disparate telemetry sources (including EDR and network/identity) into a single correlated platform.
• Knowledge of the security tooling landscape and best practices.
• Strong Linux systems administration; ability to script ingestion and transformation logic when needed.
• Working understanding of differences across EDR, firewall, identity, and CI/CD signals and the ability to detect anomalies vs baseline.
• Experience with infrastructure-as-code tooling (Ansible, Terraform) for security tooling deployment and maintenance.
• Strong Git and change management experience.

Benefits

• Initial 6-month contract
• Hybrid in Dublin
• Start ASAP