Security Data Engineer

Deloitte's Government & Public Services practice is seeking a Project Security Engineer III, for our Cyber -Enterprise Security team to support clients in strengthening and scaling cybersecurity capabilities across complex environments.

This role focuses on helping organizations design, implement, and improve enterprise security solutions that align to business and mission needs.

The ideal candidate brings experience supporting security engineering, control implementation, and cross-functional delivery in dynamic client settings.

Our Deloitte Cyber team understands the unique challenges and opportunities businesses face in cybersecurity.

Join our team to deliver powerful solutions to help our clients navigate the ever-changing threat landscape.

Through powerful solutions and managed services that simplify complexity, we enable our clients to operate with resilience, grow with confidence, and proactively manage to secure success.

Recruiting for this role ends on 12/01/2026.

Work You'll Do

As a Security Data Engineer, on the Enterprise Security team, you will be responsible for: • Design, write, and deploy high-fidelity detection rules using SQL, Sigma, YARA-L, or Python targeting network-based attack techniques (e.g., C2 beaconing, data exfiltration, and lateral movement).
• Continuously tune network detections to reduce false-positive rates while maintaining a high signal-to-noise ratio.
• Identify telemetry required to support network monitoring, threat hunting, incident response, and custom detection engineering.
• Map detection requirements to underlying data sources and identify visibility gaps across hybrid cloud and on-premises environments
• Design and maintain pipelines that ingest security telemetry from network, endpoint, identity, cloud, application, OT, and security infrastructure.
• Ensure telemetry is delivered reliably to SIEM, data lake, analytics, and detection platforms; troubleshoot ingestion, parsing, latency, and data-quality issues.
• Evaluate whether packet, flow, session, DNS, proxy, authentication, endpoint, and application telemetry is sufficient for specific detection requirements.
• Support custom detection development through data discovery, enrichment, normalization, and validation.
• Identify opportunities to move detections from low-level indicators toward higher-level behavioral and tradecraft-based detection using the Detection Stack.
• Work with network engineering teams to evaluate technologies such as network sensors, NetFlow/IPFIX, DNS telemetry, proxy telemetry, firewall logs, IDS/IPS, packet capture, Zeek/network metadata, and NDR platforms.
• Establish telemetry health metrics, dashboards, and automated checks for missing, delayed, or malformed data.
• Assess network visibility across data centers, cloud environments, remote networks, and segmented environments.
• Optimize telemetry architectures and ingestion pipelines for performance, scalability, reliability, and cost
A ...