SQL/Python ETL Engineer – Cybersecurity Data Pipelines
A growing data function supporting cybersecurity and enterprise analytics is hiring an ETL engineer to build the pipelines that keep detection engineering, threat analytics, and reporting fed with clean, reliable data. If you enjoy turning messy, high-volume log data into trustworthy datasets, this role gives you real ownership over how security telemetry flows from source to insight.
This role will be on an initial 12 month contract
What you'll be doing
- Building and maintaining pipelines that ingest, normalize, and transform cybersecurity telemetry from syslog, XML, JSON, and API sources
- Tuning cloud data warehouse performance and cost as pipeline volume grows
- Partnering with security teams to translate log sources and detection requirements into reusable data models
- Routing and enriching log data through platforms such as Splunk or Cribl
- Putting schema management, data quality checks, and monitoring in place so issues get caught early
- Keeping data handling secure and compliant throughout
What you'll bring
- Working knowledge of cybersecurity concepts — SIEM, EDR, identity and network logs, threat detection — with hands-on experience in platforms like Splunk, Cribl, or Elastic
- 3+ years building ETL/ELT pipelines
- Strong SQL (complex joins, analytical functions, performance tuning) and Python (pandas, PySpark or similar)
- Exposure to cloud data warehouses, ideally Snowflake
- Comfort working with JSON-heavy and other semi-structured data at scale
- A solid grip on Git, CI/CD, and modern DevOps practices
- Confident English communication
Nice to have
- Exposure to MITRE ATT&CK, detection engineering, or SOC workflows
- Familiarity with Snowpark, dbt, or Airflow
- Background working to ISO 27001 or SOC 2 aligned practices
- Experience ingesting logs from AWS, Azure, or GCP
- An interest in AI-accelerated development and Agile ways of working
Argyll Scott Asia is acting as an Employment Business in relation to this vacancy.
