Cribl Data Analytics Engineer

We are supporting a leading financial services organisation in London seeking an experienced Cribl Data Analytics Engineer to join a large-scale Cyber Security and Observability programme.

The successful candidate will be responsible for designing implementing and optimising data pipelines using Cribl technologies ensuring the efficient collection transformation routing and analysis of security and operational telemetry data across enterprise environments.

This role will work closely with Cyber Security SOC Infrastructure Cloud Data Engineering and Application teams to improve data visibility reduce SIEM costs and enhance security monitoring capabilities.

• Design deploy and manage Cribl data pipelines across enterprise environments.
  
• Configure and support Cribl Stream including data collection transformation filtering enrichment masking and routing.
  
• Optimise telemetry ingestion into SIEM and observability platforms.
  
• Implement data reduction strategies to improve platform efficiency and reduce licensing costs.
  
• Develop and maintain data parsing normalisation and enrichment processes.
  
• Support integration with security and monitoring platforms such as Splunk Microsoft Sentinel Elastic and Datadog.
  
• Troubleshoot data ingestion routing and pipeline performance issues.
  
• Work with Security Operations teams to ensure required log sources are onboarded and monitored.
  
• Support cloud and hybrid environments including Azure AWS and on-premises infrastructure.
  
• Create dashboards reports and analytics to support operational and security use cases.
  
• Document solutions operational procedures and technical designs.
  
• Participate in change management testing and production deployments.
  
• Provide technical guidance and knowledge transfer to operational teams.
  

• Strong hands-on experience with:
  • Cribl Stream
    
  • Cribl Search
    
  • Cribl Edge
    
  • Cribl Lake (desirable)
    
• Experience building and managing large-scale data pipelines.
  
• Strong understanding of data routing filtering enrichment and transformation.
  

• Experience working with:
  • Splunk
    
  • Microsoft Sentinel
    
  • Elastic Stack
    
  • Datadog
    
  • Security Information and Event Management (SIEM) platforms
    
• Understanding of SOC operations and security monitoring requirements.
  
• Experience onboarding security log sources.
  

• Strong log analysis and troubleshooting skills.
  
• Experience with structured and unstructured data.
  
• Knowledge of JSON Syslog REST APIs and common log formats.
  
• Experience developing dashboards and reporting solutions.
  

• Azure and/or AWS experience.
  
• Understanding of Windows and Linux environments.
  
• Networking fundamentals including TCP/IP DNS SSL/TLS and load balancing.
  

• Python
  
• PowerShell
  
• Bash/Shell scripting
  
• API integration and automation
  

• Financial Services or Investment Banking experience.
  
• Large-scale observability or cyber transformation programmes.
  
• Experience with OpenTelemetry.
  
• Experience with Infrastructure as Code (Terraform).
  
• Experience with Kubernetes and containerised environments.
  
• Exposure to DevOps and CI/CD pipelines.
  

• Strong analytical and problem-solving skills.
  
• Excellent stakeholder management and communication skills.
  
• Ability to work independently within complex enterprise environments.
  
• Strong documentation and reporting skills.
  
• Collaborative approach with cross-functional technical teams.
  

• Successful onboarding of security and operational data sources.
  
• Optimised Cribl pipelines reducing unnecessary data ingestion.
  
• Improved visibility and monitoring across security platforms.
  
• Accurate and reliable data routing to multiple destinations.
  
• Documentation and operational handover to support teams.