Splunk SME

Role: Splunk SOAR & Splunk Engineer/ SME

Location: Baltimore, MD

Key Responsibilities

• Design, develop, and maintain automated playbooks using Splunk SOAR (Phantom) to streamline SOC workflows.
• Integrate SOAR with security tools, IT systems, ticketing platforms, and threat intelligence feeds.
• Administer and optimize Splunk Enterprise in distributed, high-ingest environments.
• Implement Splunk best practices for indexing, data models, SPL optimization, and knowledge objects.
• Manage data ingestion and routing using Cribl, and leverage Redis for caching and enrichment.
• Develop SQL-based integrations for data correlation, enrichment, and reporting.
• Collaborate with SOC and IT teams to align automation with detection and response strategies.
• Monitor Splunk platform health, scalability, and redundancy.

Essential Skills

• 5+ years of hands-on experience with Splunk Enterprise, including multi-TB daily ingest environments.
• 2+ years of Splunk SOAR (Phantom) playbook design and development experience.
• Advanced SPL knowledge, search optimization, and object management.
• Strong experience with Cribl, Redis, and SQL for data ingestion, enrichment, and correlation.
• Proficiency in Python (JSON/XML parsing, API integrations, regex); familiarity with PowerShell and Bash.
• Experience integrating REST APIs with OAuth and key-based authentication.
• Solid understanding of SOC operations, cybersecurity fundamentals, and MITRE ATT&CK framework.
• Strong knowledge of Linux/Unix administration, networking concepts, and authentication systems.
• Experience with Git/version control systems.
• Splunk Certified Admin and Splunk SOAR Developer certifications.

Nice-to-Have Skills

• Threat intelligence integrations (TAXII, MISP, Recorded Future).
• Experience with Splunk upgrades and platform migrations.
• Knowledge of Splunk MLTK, UBA, ITSI.
• Understanding of data lifecycle management (compliance, retention, normalization).
• Familiarity with Docker, Kubernetes, and DevOps practices.
• Knowledge of Zero Trust security architecture.

Experience Required

• 10+ years overall IT/Security experience.