Security Data Engineer

Founded in 1999 in Vienna, the Qualysoft Group is a manufacturer-independent IT consulting and services company, which successfully provides support for its international customers with the aim of boosting their competitiveness and economic efficiency through innovative IT solutions. Its focus is on financial services providers, telecommunications companies, the automotive industry and energy service providers. Over 400 employees in 6 subsidiaries work together to ensure state of the art solutions for our clients. We are looking for new colleagues in Qualysoft teams for diverse projects providing continuous learning opportunities. Our common goal is to provide honesty, development and a stable background while getting to know the latest technologies. We are waiting for your application for the position below! Why we think you will love working here: With us you count as a person, our doors are always open. We live the Qualysoft Team Spirit and stand for transparency! Fresh wind and new ideas are welcome, because standstill is a foreign word at Qualysoft. Responsbilities: Design, maintain, and optimize log ingestion pipelines for Elasticsearch, Kibana, and OpenSearch environments. Normalize and standardize log data using OpenTelemetry Semantic Conventions and industry best practices. Onboard, categorize, and enrich new security log sources to improve visibility and investigation capabilities. Support SOC and Detection Engineering teams by enabling cross-source correlation and high-fidelity alerting. Ensure data quality, schema consistency, and reliable operation of the security logging infrastructure. Requirements: 3+ years of experience in Data Engineering, Security Operations, Observability, or a related field. Hands-on experience with Elasticsearch, Kibana, OpenSearch, and log ingestion technologies such as Logstash, Fluentd, Fluent Bit, or Beats. Strong understanding of log formats, data normalization, OpenTelemetry, and/or Elastic Common Schema (ECS). Proficiency in Python, Go, or Node.js for building parsers, transformations, and enrichment services. Experience with Kafka, Filebeat, Logstash, or similar data pipeline technologies. Familiarity with SIEM/SOC environments, detection engineering concepts, and security event correlation. Knowledge of MITRE ATT&CK, threat detection, and anomaly detection is an advantage.