Overview
We require three Senior Data Engineers to build and operationalize observability capabilities across the SIEM ecosystem. These resources will lead efforts in designing integrated monitoring solutions for tools like Cribl Vector Splunk Snowflake ADX and Log Analytics. Their work will ensure continuous visibility into system health enabling proactive fault detection and performance management. These resources will leverage either or both Grafana and PowerBI for dashboarding.
Observability Platform Engineer
Duration: 12 months
Headcount: 3
Location: Bellevue HQ or Overland Park onsite 4 days a week
Project/Initiative: SIEM Modernization
Work Required
- Lead the architecture and implementation of a comprehensive observability strategy across the entire SIEM modernization ecosystem spanning data pipeline layers (Cribl Vector NiFi) event transport (Event Hubs) intermediate storage (Blob) and multiple downstream platforms (Splunk Snowflake ADX Log Analytics Anvilogic).
- Design and build end-to-end telemetry and traceability for data events as they move across platforms enabling real-time visibility into ingestion transformation routing and storage processes.
- Develop and maintain dashboards and alerting mechanisms to detect:
- Faults and failures (e.g. dropped messages ingestion lags retry loops)
- Latency or throughput bottlenecks across pipelines
- Schema mismatches or format errors
- Duplicate delayed or missing data
- Data quality anomalies at point of ingestion and final storage
- Instrument each pipeline component (e.g. Cribl workers Vector agents NiFi processors) with health and performance metrics using native exporters APIs or custom collectors.
- Ensure observability tooling is in place for Azure Event Hubs including partition health consumer group lag and throttling events.
- Monitor Blob storage utilization and access patterns to identify ingest failures access permission issues or object lifecycle gaps.
- Implement and enforce correlation IDs or tracing metadata to follow data across systems and detect where in the pipeline an issue originates.
- Integrate monitoring solutions with Grafana Azure Monitor and PowerBI to support multiple stakeholder needs (technical operational and executive-level views).
- Partner closely with Security Engineering Platform Engineering and Data Engineering to ensure observability insights are actionable and result in measurable improvements.
- Automate reporting of SLO/SLA adherence for pipeline uptime data integrity and ingestion latency.
- Design alert routing and severity classification ensuring appropriate escalation workflows via systems such as PagerDuty ServiceNow or Microsoft Teams.