Splunk Developer with SOAR | Onsite

My name is Avnish Rao and I am a Staffing Specialist at Stellent IT LLC. I am reaching out to you on an exciting job opportunity with one of our clients.

Role: Splunk Developer with SOAR

Location: Chicago, IL and Denver, CO

Type: Contract

WebEx and then onsite interview required.

SOAR = Security, Orchestration, Automation, and Response Platform

Client is currently seeking a Splunk SOAR Developer with our client in the financial industry located in Chicago, IL and Denver, CO. This is a 12+ month contract position.

Responsibilities:

• Design & implement playbooks for phishing, malware triage, threat client enrichment, VIP account protections, user lockouts, EDR containment, firewall updates, cloud response, and ticket lifecycle automation.
• Develop custom Splunk SOAR apps (integrations) using Python to interact with REST APIs, webhooks, OAuth2 flows, and vendor SDKs (e.g., EDR, email security, IAM, cloud, firewalls).
• Harden and scale automations: add idempotency, robust error handling, retries/backoff, caching, and distributed execution; reduce runtime and failures.
• Own integration health: monitor connectors, troubleshoot failures, resolve API changes/rate limits, and maintain credentials/key vault hygiene.
• Partner with SOC/IR: capture requirements, translate manual runbooks into automations, run UAT, measure impact, and iterate.
• Data handling: parse/transform JSON, enrich IOCs, normalize artifacts/containers, write result cards and evidence to Splunk ES/notebooks/tickets.
• Quality & governance: version control (Git), code reviews, CI/CD for playbook promotion across dev/test/prod; maintain documentation and runbooks.
• Metrics & reporting: define KPIs (MTTD/MTTR reduction, automation coverage, savings hours, error rate), publish dashboards, and drive continuous improvement.
• Security best practices: least privilege for service accounts, secrets management, audit logging, and change control (CAB) for high impact workflows.
• Support: participate in an on call or pager rotation (if required) for critical automations experience.

Requirements:

• 5-7 years' developing in Splunk SOAR (Phantom) with a portfolio of production playbooks and custom apps.
• Advanced Python (3.x): requests, async patterns, exception handling, data parsing, unit testing, packaging.
• Strong knowledge of security operations and common use cases: phishing, EDR triage/containment, sandboxing, TI enrichment, IAM actions, cloud remediation, firewall rules.
• Hands on experience integrating with several of: CrowdStrike, Defender, Carbon Black, Okta/Azure AD, Proofpoint/M365, Palo Alto/Fortinet, VirusTotal, Recorded Future, ServiceNow/Jira, AWS/Azure/Google Cloud Platform.
• Proficiency with REST APIs (auth, pagination, rate limits), JSON, and Postman/Swagger.
• Git workflows; promoting artifacts across environments with approvals and rollback plans.
• Understanding of Splunk ES, notable events, adaptive responses, and alert pipelines.
• Excellent documentation, stakeholder communication, and requirements gathering.

Thanks & Regards

Avnish Rao

Technical Recruiter

Cell-

Email-