Sr. Security Engineer (Kusto)

• Title: Sr. Security Engineer (Kusto)
• Location: Remote
• Duration: 6 Months Contract

Description:We are looking for a hands-on Senior Security Engineer to build the data foundation behind the client's security risk reporting.The role brings vulnerability and security findings from tools such as Qualys, Wiz and Xray/SBOM into one curated dataset via Kusto. That dataset gives leadership one trusted view of exposure, connects every finding to an accountable owner, and drives risk-based prioritization in ServiceNow Vulnerability Response and leadership dashboards.This is a senior individual-contributor role with a high degree of autonomy. You will design and build the pipeline yourself, guide two contract engineers day to day, and own the pipeline's data controls after go-live. The first release is planned for late January 2027, so the right candidate can contribute from the first week.What you will do

• Design the common finding model. Define the shared schema and unique finding keys across Qualys, Wiz, Xray/SBOM and other security sources.
• Build normalization and deduplication in Kusto. Turn raw source data into one record per finding using KQL, update policies and materialized views.
• Enrich findings with business context. Map every finding to its Application ID, CMDB configuration item, business unit, owner and environment, working with CMDB and CI-matching teams.
• Implement prioritization logic. Apply severity, exploitability, asset and business criticality consistently across all sources.
• Build ingestion with Ziggiz. Stand up and harden connectors and refresh schedules so sources land in Kusto reliably.
• Guide the contract engineers. Provide day-to-day technical guidance, review code and, with the project lead, keep ingestion, reporting and ServiceNow Vulnerability Response integration work aligned.
• Own the data controls. Run source-to-dashboard reconciliation, data lineage and data-quality checks, and produce evidence for audit and risk reviews.
• Migrate and retire legacy logic. Rebuild priority transformations from the current CloudQuery and dbt pipeline in Kusto and support the cutover.
• Own the pipeline in BAU. After go-live, run and evolve the platform, and mentor and onboard the engineers who support it.

Required

• 6 to 8+ years in data engineering, security engineering or a closely related field, including senior-level ownership of production systems.
• In-depth knowledge of large enterprise technology environments, including CMDB and Application ID models, access and change processes, and vulnerability management programs.
• Strong, hands-on Kusto (Azure Data Explorer) and KQL: data modeling, ingestion, update policies, materialized views and performance tuning.
• Proven experience building production data pipelines that normalize, deduplicate and join data from many sources.
• Working knowledge of vulnerability and security tooling data, such as Qualys, Wiz, SBOM/Xray, CrowdStrike or SAST/SCA tools.
• Experience designing data-quality and reconciliation controls in a regulated environment.
• Ability to guide other engineers through design and code review and explain data and risk trade-offs to senior leaders.

Preferred

• In-depth understanding of governance and compliance requirements, including control ownership, audit evidence and risk reviews.
• Experience with Ziggiz or similar ingestion platforms, and with dbt or CloudQuery.
• ServiceNow Vulnerability Response or ServiceNow CMDB data-integration experience.
• Grafana or similar dashboarding on top of Kusto.
• Familiarity with risk-based vulnerability prioritization (CVSS, EPSS, exploitability and asset criticality).
• Background in financial services or another highly regulated industry.

Pay: $65.00 - $80.00 per hour

Expected hours: 40.0 per week

Application Question(s)

• 8 to 10+ years in data engineering, security engineering or a closely related field, including senior-level ownership of production systems.
• In-depth knowledge of large enterprise technology environments, including CMDB and Application ID models, access and change processes, and vulnerability management programs.
• Strong, hands-on Kusto (Azure Data Explorer) and KQL: data modeling, ingestion, update policies, materialized views and performance tuning
• Working knowledge of vulnerability and security tooling data, such as Qualys, Wiz, SBOM/Xray, CrowdStrike or SAST/SCA tools.

Work Location: Remote