Security Tooling Engineer

Want to make an impact? We offer that Due to continued growth, we are hiring a Security Tooling Engineer to bring together security signal from across the environment: network, endpoint, identity, and CI/CD, into a single, coherent detection and response capability. The successful candidate will own log aggregation, data correlation, and alerting, turning disparate security telemetry into an actionable, unified view. This is a hands-on engineering role suited to an open-source-first, self-hosted-first technology approach. The successful candidate will be expected to build, integrate, and extend tooling directly rather than default to commercial, vendor-managed products. The specific platform is less important than the candidate's demonstrated ability to design and operate this kind of capability, and candidates from a variety of tooling backgrounds are welcome to apply. The environment is expected to evolve, and the role requires someone who can design for that - understanding how new data sources, tools, and systems can be brought into the existing platforms and detection capabilities through reusable integration patterns, rather than treating each addition as a one-off integration. Key Responsibilities: · Own and administer a central log aggregation and detection platform, including ingestion pipeline design, data retention/lifecycle management, and query/alert configuration. · Integrate telemetry from across the security landscape - EDR, network, identity, and CI/CD - into a single correlated view. · Design, build, and tune data correlation rules and alerting logic across sources, moving away from siloed, single-tool dashboards. · Maintain the underlying data pipeline (log shippers, aggregation layer, storage, and visualisation). · Identify and investigate incidents that emerge from correlation across previously disconnected data sources, like EDR alerts tied back to network/identity events. · Incorporate CI/CD pipeline and supply-chain security signals into the detection platform. · Conduct security assessments of new tools and third-party platforms prior to integration, with particular regard to data handling and compliance. · Design the correlation and detection model to be extensible, so new data sources or systems can be onboarded as requirements change, without as little reengineering required. · Provide technical support during incident response, including direct interrogation of log and event data. · Maintain technical documentation for the tooling layer to a standard suitable for handover and audit. · Envisage issues and deployment integrations for an infrastructure as code environment, and knowing when and where the considerations need to be considered. Requirements: · 3+ years' of hands-on experience with a log aggregation and detection platform (e.g. Elastic Stack, Splunk, Graylog, or comparable), at a level extending beyond dashboard configuration to pipeline design, data management, and query/detection logic. · Demonstrated experience integrating multiple, disparate telemetry sources, including EDR and network/identity data, into a single correlated platform. · Understanding of security tooling landscape and best practises and the products in the landscape. · Strong working knowledge of Linux systems administration, including the ability to script ingestion and transformation logic rather than relying solely on pre-built connectors when required. · Working understanding of how EDR, firewall, identity, and CI/CD signals differ, and the ability to distinguish baseline from anomalous behaviour across tool types. · Experience with infrastructure-as-code (e.g. Ansible, Terraform) for deployment and maintenance of security tooling. · Strong GIT and change management systems understanding. Desirable: · Experience with open-source observability or SIEM tooling (e.g. Grafana, Loki, Wazuh, Security Onion, or similar). · Detection engineering experience, authoring correlation rules and detection logic rather than relying exclusively on vendor-supplied rulesets. · Familiarity with EDR platforms and endpoint telemetry, whether commercial or open-source. · Experience deploying tooling in containerised workflows. · Familiarity with GDPR and EU data protection requirements as they apply to log retention and processing. So, are you ready to join our team? It’s important to remember, emagine is an Equal Employment Opportunity Employer; we value bringing together individuals from diverse backgrounds to develop innovative solutions for our customers. Opportunity type: Initial 6-month contract, Hybrid in Dublin Start date: ASAP