SPLUNK UEBA ANALYST

Splunk Platform Management Program | Senior Level (minimum five years in role)

Position Summary

The Splunk UEBA Analyst owns the quality of the program's behavioral analytics. Working with minimal supervision, this individual configures user and entity behavioral baselines and anomaly detection rules, develops the risk scoring models behind threat alerting, and drives the continuous tuning cycle that keeps false positives falling while detection accuracy holds. The Analyst also supports the government end users who investigate and act on UEBA findings.

Key Responsibilities

·      Design and implement user and entity behavior analytics dashboards and detection models.

·      Configure behavioral baselines and anomaly detection rules across users, devices, and applications.

·      Develop and refine the risk scoring models behind threat alerting.

·      Investigate flagged anomalies and validate findings against incident outcomes.

·      Tune and refine detections based on false positive rates and incident validation, on a continuous cycle.

·      Run recurring optimization reviews of detection rules and behavioral models.

·      Create and maintain the dashboards, searches, and reports used for behavior analysis.

·      Track and document alert efficacy, false positive reduction, and investigation outcomes, and produce the monthly alert efficacy report.

·      Support bi-directional integration between UEBA, Splunk Enterprise, and Splunk Enterprise Security for data ingestion, incident scoping, and workflow.

·      Provide training and responsive technical support to end users on UEBA analytics and investigations.

Demonstrated Hands-On Experience (Evaluation Emphasis)

The selected individual must demonstrate hands-on experience configuring and tuning a behavioral analytics platform in a production environment, preferably Splunk UBA or UEBA. The candidate shall clearly describe the models configured and tuned, the baseline and risk scoring approaches used, the false positive reduction achieved, and the investigation workflows supported, including the environments and user populations covered. Experience limited primarily to alert triage or to consuming UEBA output that others built and tuned, without substantial model configuration and tuning responsibility, will be viewed as less competitive.

Required Qualifications

·      Minimum of five years in a security analytics or security operations role, including at least two years of hands-on experience with Splunk UBA or UEBA, or a comparable behavioral analytics platform such as Exabeam or Securonix combined with demonstrated Splunk experience. Demonstrated hands-on experience is mandatory and may not be substituted.

·      Demonstrated proficiency in SPL, data analysis, and insider threat detection concepts, with working machine learning literacy sufficient to understand and tune anomaly detection and risk scoring behavior.

·      Experience documenting analytic outcomes and presenting findings to technical and non-technical audiences.

·      Relevant industry certifications are preferred where practicable, such as Splunk Core Certified Power User, GIAC GCDA, or CompTIA CySA+.

Clearance and Work Conditions

·      Place of performance: Remote work, based within United States.

·      Schedule: standard business hours, Monday through Friday, excluding Federal holidays.

·      Successfully complete an Government background investigation

·      Employers have access to artificial intelligence language tools (“AI”) that help generate and enhance job descriptions and AI may have been used to create this description. The position description has been reviewed for accuracy and Dice believes it to correctly reflect the job opportunity.

• Dice Id: 10229270
• Position Id: 9099963
• Posted 3 days ago