Threat Detection & Automation Engineer (with focus on Data Engineering)

About the Job:

We are looking for a highly motivated Security Automation Engineer with experience in Data Engineering to join NM’s Security Automation & Data Analytics team. As a member of our team, you will play a pivotal role in designing, building and maintaining continuous and sustainable automated pipelines with the goal of enhancing the efficiency, effectiveness and accuracy of cybersecurity teams’ capabilities reducing manual tasks for the IRC teams and enable data-driven cybersecurity operations. This role requires a mix of modern data engineering practices, experience in database structures and tooling, coding, cloud development, and security domain expertise.

What You'll Do:

• Design, develop, and maintain scalable data pipelines, datasets, and analytics products supporting IRC department’s reporting and analytics capabilities.
• Develop and maintain enterprise-ready ETL/ELT processes and data transformation frameworks to support data-driven initiatives.
• Design, build and support cloud-based data pipelines and data lake architectures using software and data engineering best practices.
• Ensure data quality, lineage, integrity, and governance standards are implemented throughout the data lifecycle.
• Optimize and troubleshoot existing data pipelines for performance and reliability, ensuring data quality and integrity across various data sources.
• Identify opportunities to automate workflows/processes and improve efficiency across cybersecurity teams through SOAR playbooks and Kubernetes-hosted and/or cloud-hosted pipelines.
• Assist with the design, engineering, deployment, and maintenance of custom automation tools (primarily in Python and PowerShell)
• Develop integrations with security tools and APIs.
• Evaluate and implement emerging technologies to improve cybersecurity and analytics capabilities
• Assist with the development and support of dashboards, metrics, and monitoring alerts related to the team’s and the department’s operations.
• Develop and maintain documentation related to the team’s automated workflows/products.
• Partner with data scientists, analysts, engineers, and other stakeholders to identify requirements and deliver high-quality solutions and insights.
• Provide mentorship and coaching to junior team members, fostering skill development and encouraging continuous learning.

What You'll Bring to the Role:

• 5+ years of professional development experience using SQL and Python.
• 5+ years of professional experience building data pipelines (batch and/or streaming) and data governance practices.
• Hands-on experience with modern data warehouses and large-scale data platforms; comfortable working across large-scale, structured and unstructured data.
• Deep understanding of database structures principles and best practices
• Deep understanding of data modeling, ETL/ELT design, data engineering best practices, including data integration patterns, replication, event streaming, and pipeline performance tuning.
• Hands-on experience with security automation and orchestration tools and/or software development technologies.
• Comfortable with REST API best practices and usage.
• Hands-on experience deploying content and/or systems through CI/CD environments, and tooling such as GitLab, GitLab CI, Terraform, Ansible, Kubernetes etc.
• Hands-on experience with AWS and cloud services configuration and development.
• Excellent written and verbal communications skills.
• Ability to communicate with technical and non-technical audiences.

Preferred Skills:

• Bachelor's degree in computer science, Cybersecurity, Computer Engineering, Data Engineering, Software Engineering, or related fields

• Relevant industry certifications are preferred, such as AWS Certified Data Engineer – Associate, Databricks Certified Data Engineer Associate, or Databricks Certified Data Engineer Professional, demonstrating expertise in modern cloud-based data engineering, analytics, and data platform technologies.

• Experience with Databricks
• Experience with Splunk SOAR (Phantom) and Splunk SIEM.
• Experience with Splunk SPL queries, dashboards, and alerts.
• Experience with ServiceNow development and ServiceNow data lake
• Practical experience with automation techniques using PowerShell, Bash, JavaScript, API calls, and regular expressions
• Additional coding experience in one or more programming languages – Java, C++, Go
• ServiceNow development experience
• Experience with network and/or systems administration
• Experience working in Security Operations, Incident Response, or Penetration Testing
• Hands-on experience with security technologies such as SIEM, firewalls, IDR/IPS, EDR, IAM principles and others.

What Sets you apart:

• Adaptive Communication - Adaptive Communication: Formulates strategies to be used to convey complex information about services, products, systems, or processes to targeted audiences; communicates and liaises between technical and non-technical audiences.
• Data Architecture - Data Architecture: Designs and maintains the structure of logical and physical data assets and data management resources; develops and governs policies and processes for data collection, storage, arrangement, integration, and usage of data.
• Data ETL - Data ETL: Extracts, transforms, and loads data from multiple sources to a data warehouse or unified data repository.
• Databases & Data Platforms - Databases & Data Platforms: Utilizes knowledge of databases to access, manage, and update information, typically containing aggregations of data records or files; includes understanding of different types of databases.
• Engineering Expertise & Practices - Engineering Expertise & Practices: Applies specialized experiences in different facets of engineering, including data, applications, cyber, systems, operations, product, security, and testing, along with technical aptitude to adapt new expertise as they become relevant through an understanding of underlying engineering principles.
• Programming Languages - Programming Languages: Demonstrates proficiency in one or more programming languages to execute activities, tasks, practices, and deliverables associated with writing and modifying programs and scripts that comprise an application system; designs, codes, tests, and installs complex computer programs and maintains detailed documentation of programming tasks.
• SQL - SQL: Applies clear, logical codes for small and large-scale projects using the language constructs and object-oriented approach of SQL to manage data in a database management system.

#LI-Hybrid

Compensation Range:

Pay Range - Start:

$130,800.00

Pay Range - End:

$196,200.00

Geographic Specific Pay Structure:

Structure 110:

$143,920.00 USD - $215,880.00 USD

Structure 115:

$150,400.00 USD - $225,600.00 USD We believe in fairness and transparency. It’s why we share the salary range for most of our roles. However, final salaries are based on a number of factors, including the skills and experience of the candidate; the current market; location of the candidate; and other factors uncovered in the hiring process. The standard pay structure is listed but if you’re living in California, New York City or other eligible location, geographic specific pay structures, compensation and benefits could be applicable, click here to learn more.

Grow your career with a best-in-class company that puts our clients' interests at the center of all we do. Get started now!

Northwestern Mutual is an equal opportunity employer that welcomes talented individuals of all backgrounds. We are committed to creating and maintaining an environment in which each employee can contribute creative ideas, seek challenges, assume leadership and continue to focus on meeting and exceeding business and personal objectives.