Security Architect - Consultant - Data Modeling Engineer (Cribl)

Cribl data modeling and log-pipeline engineering is the central requirement for this role

Do not move forward with a candidate unless the required hands-on Cribl experience, enterprise security engineering experience, SIEM experience, Python/Bash scripting, operating-system security experience, rate expectations, screening requirements, education/experience requirements, work-location requirements, and required submission documents have been confirmed.

Job Information

• Working Title: Security Architect – Consultant – Data Modeling Engineer (Cribl)

• Category: IT / Cybersecurity

• Visa: W2 (USC/GC Independent), Locals

This position is 100% remote

• Location: Columbia, South Carolina 29210

• Preference will be given to the candidates located in or near South Carolina who can occasionally report onsite are preferred.

Position Overview

• The State of South Carolina is seeking an experienced Security Architect – Consultant – Data Modeling Engineer with deep hands-on experience using Cribl to design, implement, and maintain enterprise security-data pipelines.

• This is not a general cybersecurity architect or SIEM administrator position.

• The central requirement is hands-on experience with Cribl data modeling, log-pipeline design, implementation, routing, transformation, and delivery of security telemetry into enterprise SIEM environments .

• The selected consultant will work alongside full-time security architects and engineers supporting large-scale enterprise cybersecurity initiatives.

• The role combines Cribl engineering with broader hands-on security engineering across SIEM, XDR, vulnerability management, DLP, endpoint security, Linux security sensors, Windows/Linux security configuration, security integrations, automation, threat detection, and defensive security architecture .

• Automation is also important. Candidates should demonstrate experience building integrations and security automation using scripting languages such as Python and Bash .

• The strongest candidates will have substantial experience operating within complex enterprise security environments rather than simply having exposure to Cribl or SIEM technologies.

Scope of Project

The selected consultant will support:

• Cribl data modeling

• Cribl Stream / log-pipeline architecture

• Enterprise log ingestion

• Security-data routing

• Parsing and transformation of security telemetry

• Data normalization and enrichment

• SIEM data delivery and integration

• SIEM administration, analysis, and reporting

• Enterprise security architecture

• Security-tool implementation and support

• XDR technologies

• Vulnerability-management platforms

• Data Loss Prevention / DLP

• Endpoint security

• Linux-based security sensors

• Windows and Linux security configuration

• Security-system hardening

• Cybersecurity automation

• Python scripting

• Bash scripting

• Security integrations

• Threat detection

• Defensive security strategies

• Networking and secure-system design

• Security controls and countermeasures

• Security-control validation

• Incident-detection support

• Enterprise cybersecurity engineering

Daily Duties / Responsibilities

The selected candidate will:

• Design, build, implement, and maintain Cribl data models and log pipelines

• Develop enterprise security-data ingestion and routing workflows

• Configure pipelines that deliver security telemetry into enterprise SIEM environments

• Perform data parsing, filtering, transformation, enrichment, routing, and normalization

• Work directly with enterprise security architects and engineers

• Support SIEM administration, analysis, and reporting

• Implement and support enterprise security technologies

• Support XDR platforms

• Support vulnerability-management technologies

• Support DLP technologies

• Support endpoint-security platforms

• Build and deploy Linux-based security sensors

• Support Linux and Windows security configuration and hardening

• Develop security automation and integrations using Python and Bash

• Support enterprise threat-detection capabilities

• Assist with defensive-security engineering

• Support security-control implementation and validation

• Participate in enterprise security architecture discussions

• Support incident-detection activities

• Troubleshoot complex security-data and integration issues

• Support secure networking and system-design initiatives

• Participate in the required on-call rotation

Required Qualifications

The candidate must have:

• Hands-on Cribl data modeling experience

• Cribl log-pipeline design and implementation experience

• Strong understanding of enterprise security architecture and engineering principles

• Experience implementing and supporting enterprise security tools

Security-tool experience should include exposure to technologies such as:

• SIEM

• XDR

• Vulnerability Management

• Data Loss Prevention / DLP

• Endpoint Security

The candidate must also have:

• Experience developing automation and integrations using Python and/or Bash

• Knowledge of cybersecurity best practices

• Threat-detection experience

• Defensive-security knowledge

• Linux operating-system experience

• Windows operating-system experience

• System-hardening experience

• Security-configuration experience

• Understanding of networking concepts

• Understanding of security protocols

• Understanding of secure-system design

• 5+ years of experience supporting large IT environments and/or enterprise system deployments

All required experience should be clearly and explicitly documented in the resume .

Do not rely solely on a skills section or broad statements such as:

• "Cribl"

• "SIEM"

• "Cybersecurity"

• "Security Architecture"

• "Python"

The resume should establish what the candidate actually designed, configured, implemented, supported, automated, integrated, or administered.

For Cribl specifically, the resume should demonstrate meaningful hands-on responsibility rather than simple platform exposure.

Required Education

The candidate should have:

• Bachelor's degree in an Information Technology-related field

OR

• Bachelor's degree in a Security-related field

OR

• 8+ years of relevant professional experience may be substituted in lieu of the degree requirement

Please confirm the candidate's education and/or qualifying equivalent experience before submission.

Preferred Qualifications

Preferred experience includes:

• Hands-on Cribl data modeling experience

• Advanced Cribl Stream experience

• SIEM administration

• SIEM analysis

• SIEM reporting

• Building and deploying Linux-based security sensors

• Enterprise cybersecurity engineering

• Security architecture

• Security automation

• Security-system integration

• NIST Cybersecurity Framework / NIST CSF

• CJIS

• IRS Publication 1075

• CMS MARS-E

Preferred certifications include:

• CISSP

• Security+

The strongest candidates will demonstrate multiple preferred qualifications, but hands-on Cribl remains the most important technical signal .

Additional Skills

The candidate should also demonstrate:

• Strong enterprise security-engineering capabilities

• Strong troubleshooting and analytical skills

• Strong technical communication skills

• Ability to work with security architects and engineering teams

• Ability to design scalable security-data pipelines

• Ability to troubleshoot log-ingestion and routing issues

• Ability to automate repetitive security-engineering processes

• Ability to understand complex security-data flows

• Strong Linux skills

• Strong Windows-security knowledge

• Strong networking fundamentals

• Ability to work independently in a remote environment

• Ability to participate in an on-call environment

Target Candidate Profile

Focus on candidates with backgrounds such as:

• Cribl Engineer

• Cribl Stream Engineer

• Security Data Engineer

• Security Data Pipeline Engineer

• SIEM Engineer

• Senior SIEM Engineer

• Security Engineer

• Senior Security Engineer

• Security Architect

• Cybersecurity Engineer

• Security Platform Engineer

• Security Automation Engineer

• Logging / Telemetry Engineer

• Observability Engineer

• Detection Engineer

• Security Infrastructure Engineer

The strongest candidates will have:

• 5+ years of enterprise IT/security experience

• Real hands-on Cribl Stream experience

• Cribl data modeling experience

• Cribl pipeline-design experience

• Log-ingestion experience

• Log-routing experience

• Parsing and transformation experience

• Data normalization experience

• Security telemetry experience

• Enterprise SIEM experience

• SIEM administration or engineering experience

• Python scripting experience

• Bash scripting experience

• Linux security experience

• Windows security experience

• Security automation experience

• Security-tool integration experience

• XDR experience

• Vulnerability-management experience

• DLP experience

• Endpoint-security experience

• Networking/security-protocol knowledge

• Threat-detection experience

• Defensive-security experience

• Experience supporting large enterprise environments

Especially strong profiles may combine Cribl with SIEM platforms such as:

• Splunk

• Microsoft Sentinel

• IBM QRadar

• Elastic / Elasticsearch

• Other large-scale enterprise SIEM platforms

Cribl Screening Standard

Treat Cribl as a true knockout requirement .

Do not move forward based solely on a candidate mentioning Cribl in a skills section.

During screening, confirm specifically whether the candidate has personally:

• Designed Cribl pipelines

• Built Cribl Stream pipelines

• Configured routing rules

• Parsed log data

• Transformed security data

• Filtered data

• Enriched data

• Normalized security telemetry

• Reduced or optimized log volume

• Built integrations between security-data sources and SIEM platforms

• Troubleshot Cribl pipeline failures or data-flow issues

• Supported Cribl in a production enterprise environment

Candidates should be able to explain their Cribl architecture, data sources, destinations, transformations, routing logic, and SIEM integrations in detail.

Avoid candidates whose backgrounds are primarily focused on:

• General cybersecurity with no Cribl experience

• SIEM administration with no Cribl experience

• Splunk administration without Cribl pipeline engineering

• SOC Analyst work without security-engineering responsibilities

• Security architecture without hands-on implementation

• GRC / governance / risk / compliance

• IAM-only roles

• Network-security roles without security-data pipeline experience

• DevOps roles without cybersecurity engineering

• Observability roles without enterprise security-data responsibilities

• Candidates who list Cribl only in a skills section

• Candidates who have only been exposed to Cribl but have not built or supported pipelines

• Candidates without meaningful Python or Bash scripting experience

• Candidates without enterprise security-tool experience

• Candidates without Linux and Windows experience

• Candidates previously submitted to Solicitation 11439

Required Candidate Information

Before submission, collect and confirm:

• Work authorization

• Current and future sponsorship requirements

• Ability to work directly on CornerStone's W-2, when required

• Full legal first name

• Full legal middle name, when applicable

• Full legal last name

• Personal phone number

• Personal email address

• Current resident city and state

• Ability to work remotely within the United States

• Ability to work 40 hours per week

• Rate expectations and acceptance

• Start availability for October 26, 2026

• Virtual interview availability and commitment

• Ability to attend an in-person final interview if required

• Willingness to occasionally travel to Columbia, South Carolina if requested

• Understanding that any onsite travel expenses are the resource's responsibility

• No conflicting Right to Represent with another vendor

• Confirmation candidate was not previously submitted to Solicitation 11439

• Education or qualifying equivalent experience

Must also confirm that the candidate has:

• Hands-on Cribl experience

• Cribl data modeling experience

• Cribl log-pipeline design experience

• Cribl implementation experience

• Enterprise SIEM experience

• Enterprise security architecture or engineering experience

• XDR experience, when applicable

• Vulnerability-management experience, when applicable

• DLP experience, when applicable

• Endpoint-security experience

• Python scripting experience

• Bash scripting experience

• Linux experience

• Windows experience

• System-hardening/security-configuration experience

• Networking knowledge

• Security-protocol knowledge

• Secure-system-design knowledge

• Threat-detection experience

• Defensive-security experience

• At least 5 years supporting large IT environments and/or enterprise system deployments

Preferred experience should also be confirmed when applicable:

• Hands-on SIEM administration

• SIEM analysis

• SIEM reporting

• Linux-based security-sensor deployment

• NIST CSF

• CJIS

• IRS 1075

• CMS MARS-E

• CISSP

• Security+