Splunk SIEM Notables Automation Engineer

Title: Splunk SIEM Notables Automation Engineer W2 Contract
Location: Phoenix, AZ (Hybrid )
Duration: 12+ Months
Employment Type: W2 Only No C2C

Job Description:
We are hiring a Splunk SIEM Automation Engineer with expertise in Splunk Core and SPL (Splunk Processing Language) to support our client's enterprise security operations. You will focus on Notables Automation within Splunk Enterprise Security (ES), streamlining threat detection, enrichment, and automated response.

Key Responsibilities:

• Develop and optimize SPL queries for dashboards, alerts, and correlation rules.

• Automate Splunk Notable Events and alert workflows using SOAR tools (e.g., Splunk SOAR/Phantom).

• Configure alert enrichment, severity tuning, and alert suppression mechanisms.

• Integrate Splunk alerts with external systems like ServiceNow or Jira.

• Collaborate with SOC, Threat Intelligence, and Engineering teams to improve alert fidelity.

• Monitor data ingestion, parsing accuracy, and notable event volumes.

• Document workflows and assist in creating automation playbooks.

Required Skills:

• 4+ years experience in Splunk Core, SPL, and Enterprise Security.

• Strong understanding of SIEM Notables Automation and correlation logic.

• Hands-on experience with SOAR platforms and security alert lifecycle.

• Knowledge of log sources, CIM, and security data normalization.

• Familiarity with security operations, threat detection, and incident response.

Preferred Qualifications:

• Splunk certifications (Power User, Admin, or ES Admin).

• Scripting experience (Python, PowerShell, Bash).

• Experience with MITRE ATT&CK, NIST, or CIS security frameworks.

Work Authorization:
W2 Only
No C2C or Third-Party Agencies