Security Tooling Engineer

emagine Polska is hiring for a Security Tooling Engineer role based in Dublin with hybrid work arrangement. The role focuses on integrating security signals from network, endpoint, identity, and CI/CD into a unified detection and response platform using an open-source-first approach.

• Minimum 3 years hands-on experience with a log aggregation and detection platform such as Elastic Stack, Splunk, or Graylog, beyond dashboard configuration involving pipeline design and query/detection logic.
• Proven ability to integrate multiple telemetry sources including EDR, network, and identity data into a single platform.
• Strong understanding of the security tooling landscape and best practices.
• Proficient in Linux system administration with scripting capability for data ingestion and transformation.
• Knowledge of different signal types from EDR, firewall, identity, and CI/CD, and ability to distinguish anomalous behavior.
• Experience with infrastructure-as-code tools like Ansible or Terraform for deploying and maintaining security tooling.
• Strong experience with GIT and change management systems.

Desirable:

• Experience with open-source observability or SIEM tools such as Grafana, Loki, Wazuh, or Security Onion.
• Detection engineering skills including authoring correlation rules and detection logic.
• Familiarity with EDR platforms and endpoint telemetry.
• Experience deploying tooling in containerized workflows.
• Understanding of GDPR and EU data protection impacts on log retention and processing.

• Own and administer a central log aggregation and detection platform, including ingestion pipeline design, data retention lifecycle, and query/alert configuration.
• Integrate telemetry across EDR, network, identity, and CI/CD into a unified correlated view.
• Design, build, and tune data correlation rules and alerting logic.
• Maintain underlying data pipeline components such as log shippers, aggregation layers, storage, and visualization.
• Identify and investigate incidents from correlation across disconnected data sources.
• Incorporate CI/CD pipeline and supply-chain security signals into the detection platform.
• Conduct security assessments of new tools and third-party platforms focusing on data handling and compliance.
• Design detection and correlation models to support extensibility for new data sources.
• Provide technical support during incident response including log and event data interrogation.
• Maintain technical documentation suitable for handover and audit.
• Plan and foresee deployment integrations in an infrastructure as code environment.

The opportunity is an initial 6-month contract based in Dublin with a hybrid schedule. emagine is an Equal Employment Opportunity Employer valuing diversity. Data processing for recruitment is subject to relevant legal conditions and candidate consents according to the provided information clause.