Role OverviewWe are seeking a skilled Splunk SIEM Engineer to lead the evolution of our Splunk environment into a fully operational, enterprise-grade Security Information and Event Management (SIEM) platform. This role will be responsible for both the build-out and ongoing operations of the platform, ensuring it delivers reliable, actionable security insights and supports evolving cybersecurity initiatives.
What You Will Do
Lead the transformation of the Splunk environment into a fully functional SIEM platform, manage and optimize the data ingestion pipeline, configure and maintain Splunk Enterprise Security (ES) and Splunk security orchestration, automation, and response platform (SOAR), develop and maintain correlation searches, detections, and use cases, and create and tune alerts to improve fidelity and reduce false positives.
Why It Might Be a Fit
A SecurityX, CASP, or equivalent DoD 8140 IAT-3 certification is required. Experience with Splunk Enterprise and Splunk Enterprise Security (ES) is necessary. Strong understanding of SIEM architecture, design, and operations is also required.
Requirements
- SecurityX, CASP, or equivalent DoD 8140 IAT-3 certification
- Interim DoD Secret security clearance or higher
- Hands-on experience with Splunk Enterprise and Splunk Enterprise Security (ES)
- Strong understanding of SIEM architecture, design, and operations
- Experience with log ingestion, parsing, normalization, and CIM mapping
- Proficiency in developing correlation searches, alerts, and dashboards
- Experience tuning SIEM content to reduce false positives and improve detection accuracy
- Familiarity with data onboarding strategies and license optimization
- Knowledge of cybersecurity principles, threat detection, and incident response
- Experience with system administration tasks including patching, upgrades, and performance monitoring
Benefits
- Competitive paid vacation package with 11 paid federal holidays
- High-quality, low-deductible healthcare plans
- Pet insurance
- Competitive 401K package
]]>