Senior Splunk Engineer

We have a client in Illinois searching for a Sr. Splunk Engineer. You will play an important role in ensuring that security logs are appropriately formatted, ingested, tagged, and used to detect possible security events. This is a 12 month project to start but we do expect extensions in duration. It will be 100% remote based working on the central time zone. We can only use W2 applicants.

Typical tasks may include:

Integrate new data sources, which may include databases, APIs, files, etc. This may involve setting standards and working with IT administrators to update their configurations

Validating and creating appropriate configurations for CIM compliant logs

Processing requests from cybersecurity analysts for new detections within Splunk Enterprise Security

Analyzing existing logs to identify poorly formatted logs and potential gaps when implementing new detections

Adding and maintaining threat feeds within Splunk Enterprise Security

Monitoring the performance of and tuning detections

Managing asset and identity inventory within Splunk Enterprise Security

Creating and maintaining new Splunk apps

Recommending additions or changes to Splunk or its data models to meet detection needs

Developing searches, reports, and other functionalities for cyber-based use-cases, including active response, intrusion detection, vulnerability management, and related use cases

Assisting users with creating and optimizing searches and dashboards and mentoring others in good development of said resources.

A candidate is expected to:

Capture business requirements and implement the requirements
Analyze data and perform initial planning to address identified issues
Assist with the creation of playbooks to address identified issues from analysts
Seek to understand the intention of detections and corresponding playbooks
Provide basic feedback on existing playbooks and detections
Identify telemetry quality and visibility issues (SIEM parsing/normalization, EDR/XDR sensor health, asset/identity tagging).

An improved candidate would also:
Provide advanced recommendations to address gaps in logging and detections based on an analysis of threats and data
Create detailed and thorough testing plans to ensure higher chance of accurate detections
Produce clear metrics and reports (FP rate, backlog) for technical and executive audiences

An excellent candidate would also:
Create advanced use cases for detections based on an analysis of threats and data, including sample criteria to identify the behavior and mapping detections to MITRE ATT&CK
Drive continuous improvements to existing processes or tooling
Perform quality reviews and improve detections and actions
Coach, guide, teach others on the team in use of Enterprise Security

Minimum Qualifications:
Significant experience with Splunk and Splunk Enterprise Security
Significant experience with event logging solutions (e.g., Splunk Universal Forwarder, syslog, Cribl)
Experience with ticketing/case management.
Experience with Git pipelines
Familiarity with using Linux CLI
Ability to craft queries using common languages; comfort with regex, JSON and APIs; basic scripting in Python/PowerShell/Bash.

Preferred Additional Qualifications
Strong grasp of TCP/IP, OSI model, and common protocols (HTTP, DNS, SMTP). Windows/Linux/macOS fundamentals; Active Directory/Azure AD concepts; basic cloud logging.
Experience in system and network administration.
Relevant cybersecurity experience including investigations and data analysis.
Experience with SOAR tools and automation development.
Experience using identity security/management tools (e.g., Entra ID, Active Directory, Shibboleth, CrowdStrike Identity Protection).
Cloud security experience (e.g., CloudTrail/GuardDuty, Azure Defender/M365, Google Cloud Platform Security Command Center).