Job Code: TBD Job Code Name: Security Engineering - Technical Specialist Business Title: Security Data & SIEM Engineer (Cribl & SIEM) Location: India / China What you will do: As part of Johnson Controls’ Global Zero Trust & Security Analytics team, the Security Data & SIEM Engineer will be responsible for the day-to-day operation, management, and optimization of our enterprise security logging pipeline and SIEM platform. This role is heavily focused on Cribl Stream log stream processing, log parsing, and CrowdStrike NextGen SIEM data onboarding, with secondary focus on Global event routing and Security Data Fabric integration across enterprise security platforms. How you will do it: Primary Focus: Cribl Log Stream Engineering & SIEM Data Operations Daily Operations & Telemetry Health: Serve as the operational SME for the Cribl Stream pipeline and CrowdStrike NextGen SIEM environment. Conduct daily health checks, monitor log flow metrics, and resolve ingestion disruptions or collector errors. Log Ingestion, Parsing & Schema Normalization: Onboard new enterprise log sources (Firewalls, EDR, Web Proxies, Active Directory, Cloud logs). Create and maintain Cribl routes, pipelines, event breakers, and custom parsers to ensure standardized schema mapping. Log Cost Optimization & FinOps: Implement intelligent filtering, deduplication, and routing rules in Cribl Stream to strip unnecessary log noise, optimizing cloud storage (Azure Event Hubs) and SIEM license utilization. Troubleshooting & Recovery: Investigate API token expirations, network timeouts, and log schema drift. Utilize monitoring tools (such as Cribl Vision) for proactive drop-off detection and rapid incident recovery. Secondary Focus: Security Data Fabric & Infrastructure Integration Security Data Fabric Automation: Assist in connecting security telemetry between platforms (Imperva WAF, Zscaler, Firewalls, and SIEM) to automate the sharing of malicious IP/URL indicators and threat intelligence. Cloud Log Architecture Optimization: Collaborate with cloud architects to streamline Azure log collection (e.g., regional Event Hub deployments), reducing redundant workspace storage costs. Cross-Team Collaboration: Partner with SOC, Cloud Engineering, Network Security, and GRC teams to ensure high data quality, clear log ownership, and audit-compliant log retention. What we look for: Required Skills (Must-Haves): Hands-on operational experience with Cribl Stream (Routes, Pipelines, Functions, Event Breakers, Worker Groups) or equivalent log pipeline technologies (Logstash, Vector, Fluentd). Experience working with enterprise SIEM or Log Analytics platforms (CrowdStrike NextGen SIEM / Humio, Azure Log Analytics, or Splunk). Solid understanding of common log sources and formats (Syslog, JSON, CEF/LEEF, Windows Event Logs, Cloud Audit Logs, NetFlow). Practical experience with cloud logging infrastructure (Azure Event Hubs, Storage Accounts, or AWS S3/CloudWatch) and REST API data ingestion. Basic scripting and automation skills in Python, PowerShell, or Bash for API calls and log parsing. Strong troubleshooting mindset and ITIL operational experience (Incident, Change, and Problem Management via ServiceNow/Jira). Desirable Skills (Nice-to-Haves): Cribl Stream Certification (Cribl Certified Admin or User) or CrowdStrike Falcon LogScale / NextGen SIEM certifications. Understanding of Log Common Information Models (CIM) and schema mapping standards. Exposure to Security Data Fabric, Threat Intelligence feeds, or automated SOAR workflows. Familiarity with ServiceNow CMDB, Jira tracking, and building basic operational dashboards. Johnson Controls International plc. is an equal employment opportunity and affirmative action employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, protected veteran status, genetic information, status as a qualified individual with a disability, or any other characteristic protected by law. For more information, please view EEO is the Law. If you are an individual with a disability and you require an accommodation during the application process, please visit www.johnsoncontrols.com/careers. Johnson Controls: Enhancing the Intelligence of Buildings Your buildings have a purpose. They are places for people to live or work. Facilities for learning or healing. Venues for entertainment and shopping. Sites for the specialized storage of tangible goods or mission-critical data. Your buildings have a huge variety of functions; they are central to your mission. This is where Johnson Controls comes in, helping drive the outcomes that matter most. Through a full range of systems and digital solutions, we make your buildings smarter. A smarter building is safer, more comfortable, more efficient, and, ultimately, more sustainable. Most important, smarter buildings let you focus more intensely on your unique mission. Better for your people. Better for your bottom line. Better for the planet. At Johnson Controls, we’ve been making buildings smarter since 1885, and our capabilities, depth of innovation experience, and global reach have been growing ever since. Today, we offer the world’s largest portfolio of building products, technologies, software, and services; we put that portfolio to work to transform the environments where people live, work, learn and play.

Security Data & SIEM Engineer.

more at Jci.

Assistant Channel Sales Manager, Vertical Market

换热器开发工程师

Service Engineer

similar roles.

Commissary Agent

Director, App Security

Senior Analyst, SAP Security

Senior Ping Customer IAM Developer

Business Development Manager Cisco Security

Data Security Lead