Who We Are Looking For 

State Street's Cyber Data & Analytics (CyberDNA) team is seeking a Sr. Platform Operations Engineer to help shape the next generation of cybersecurity data, analytics, and AI-powered platforms. Partnering closely with Global Cyber Security, Infrastructure Teams, and Enterprise Continuity Services, this team develops advanced data platforms, intelligent automation solutions, and engineering capabilities that enable cybersecurity teams to make faster, data-driven decisions and strengthen the firm's ability to detect, prevent, and respond to evolving cyber threats. Through innovation in AI, analytics, and automation, CyberDNA plays a critical role in protecting State Street, its clients, and its partners from increasingly sophisticated global threat actors. 

The ideal candidate brings strong operational discipline, hands-on platform support experience, and the ability to lead globally distributed teams supporting high-availability cybersecurity, SIEM, observability, log management, and security operations platforms in a large enterprise environment. The ideal candidate support the operational reliability, administration, monitoring, troubleshooting, and continuous improvement of enterprise cybersecurity and SIEM platforms, including tools such as Splunk, QRadar, Elastic, and similar security operations technologies. This hands-on support leadership role will focus on production support, incident handling, user support, operational readiness, change management, ITIL processes, SOP adherence, and reporting of operational metrics in a large enterprise environment.    

What You Will Be Responsible For 

• Lead the support, administration, reliability, and day-to-day operations of enterprise cybersecurity, SIEM, observability, log management, and data platforms. 

• Support the operational roadmap for cybersecurity platform capabilities, including SIEM operations, detection support, observability, log monitoring, data ingestion, and reporting across the organization. 

• Support platform modernization and operational improvement initiatives across cybersecurity platforms, SIEM technologies, observability solutions, log management capabilities, and security operations tooling. 

• Provide technical leadership and mentorship for global support teams responsible for enterprise cybersecurity platforms, SIEM technologies, observability solutions, log management platforms, data ingestion pipelines, and operational analytics capabilities, including tools such as Splunk, Enterprise Security, Elastic Search, Cribl, Databricks, and similar security operations platforms. 

• Manage and support enterprise SIEM and cybersecurity platform components, including search, indexing, clustering, data management, platform integrations, and operational support functions across tools such as Splunk, Elastic Search, and other SIEM technologies. 

• Administer and optimize SIEM and security operations capabilities to support security monitoring, threat detection, alert triage, notable event management, and incident investigation requirements across enterprise cybersecurity platforms. 

• Optimize platform operations by using monitoring alerts, performance trends, service metrics, and operational insights to improve reliability, reduce recurring issues, lower technical debt, and strengthen service resiliency. 

• Lead platform upgrades, migrations, modernization initiatives, and service improvement programs. 

• Support enterprise log pipeline and telemetry management platforms, including tools such as Cribl, by monitoring data flow, troubleshooting routing or filtering issues, validating service health, and coordinating issue resolution with application and infrastructure teams. 

• Support integration of security and operational telemetry into Databricks Data Lake environments for analytics, reporting, and long-term data retention. 

• Monitor ingestion health, data quality, storage utilization, platform performance, and service availability across SIEM, log management, telemetry pipeline, and data platform environments. 

• Partner with Cyber Security, Infrastructure, Cloud Engineering, Application, and Service Management teams to support production issues, troubleshoot platform events, coordinate change activities, and deliver stable operational outcomes. 

• Hands-on experience with Anvilogic and Crogl or similar SIEM detection engineering platforms for detection engineering, SIEM use case development, alert workflow support, and threat detection operations. 

• Improve operational support workflows for alerting, monitoring, telemetry pipeline health, incident response, and observability use cases to reduce manual effort and improve service reliability. 

• Lead incident response, root cause analysis, problem management, change execution, and continuous improvement activities. 

• Define, implement, and continuously improve operational standards, governance, documentation, monitoring procedures, SOPs, and support models aligned to ITIL, change management, and Log Telemetry Monitoring control requirements, while measuring success through operational metrics and service performance indicators. 

• Ensure compliance with enterprise security, audit, regulatory, and data lifecycle management requirements. 

• Mentor engineers, coordinate global support teams, manage vendor engagement, and contribute to strategic technology planning. 

​

What We Value 

These skills will help you succeed in this role 

• Strong experience administering and supporting enterprise SIEM, cybersecurity, observability, and log management platforms in large-scale enterprise environments, including tools such as Splunk, QRadar, Elastic Search, and other similar SIEM/security operations technologies. 

• Deep understanding of SIEM concepts, security monitoring operations, threat detection, incident response, notable events, correlation searches, data models, and risk-based alerting. 

• Experience with log management, observability, monitoring, operational analytics, and enterprise data onboarding frameworks. 

• Hands-on experience with Cribl Stream and data pipeline management, including routing, filtering, transformation, and optimization of machine data. 

• Experience integrating log and security telemetry into Databricks Data Lake platforms for advanced analytics, reporting, and data science use cases. 

• Experience supporting cloud-based platforms, preferably AWS, along with strong Linux/Unix administration and troubleshooting skills. 

• Experience using scripting, automation, and version control practices to streamline operational support tasks, improve monitoring, reduce manual effort, and enhance platform reliability. 

• Working knowledge of ServiceNow, Jira, and Confluence for incident, problem, change, service request, Agile delivery, and technical documentation processes. 

• Knowledge of ITIL processes, operational best practices, compliance requirements, and service management disciplines. 

• Excellent communication, stakeholder management, and collaboration skills, with the ability to explain technical concepts to technical and non-technical audiences. 

• Strong ability to coordinate effectively with global teams across multiple time zones while managing multiple priorities. 

• Experience working in large enterprise environments supporting mission-critical platforms with high service availability and operational excellence expectations. 

​

Education & Preferred Qualifications 

• Bachelor’s degree in Computer Science, Engineering, Information Systems, or a related field. 

• 10+ years of technology infrastructure, platform engineering, security operations, or enterprise monitoring experience. 

• 5+ years of technical leadership experience in a large enterprise environment. 

• Experience with cloud, DevOps, Splunk, observability, SIEM, security operations, or data platform technologies. 

• Relevant certifications preferred, such as AWS, Splunk, ITIL, CISSP, or related technology/security certifications. 

​

Required Technical Skills 

• Enterprise SIEM, cybersecurity platforms, security monitoring, log monitoring, and observability platforms, including tools such as Splunk, QRadar, Elastic Search, Enterprise Security, and other similar SIEM technologies 

• SIEM, security monitoring, log monitoring, and observability platforms 

• Cribl data collection, routing, transformation, and optimization 

• Databricks Data Lake and enterprise data pipeline integration 

• AWS Cloud Services and Linux/Unix Administration 

• Python/Shell scripting and automation for operational support, troubleshooting, monitoring, and service reliability improvements 

• ServiceNow, Jira, and Confluence 

• ITIL processes and incident, problem, and change management 

• Global team collaboration and production support 

​