OZ Solutions Group is a technology services company delivering IT and cybersecurity solutions to government and public sector clients across New York City. We are seeking a hands-on Splunk Engineer (SIEM) for a 12-month contract supporting a highly visible cybersecurity program for a large-scale public sector organization in Lower Manhattan.
This is a hands-on Splunk engineering role — not a SOC analyst or monitoring seat. You will own the engineering, administration, and health of a distributed Splunk environment (cloud and/or hybrid), build the detection and reporting content the citywide Security Operations Center (SOC) relies on, and automate the operational work around it. You should be comfortable whiteboarding and defending an end-to-end Splunk architecture.
Responsibilities:
- Engineer and administer distributed Splunk — search head and indexer clusters, deployment server/deployer, license manager, and heavy/universal forwarder management across a cloud and/or hybrid deployment
- Onboard and normalize log sources (application, database, network, cloud, endpoint) — sourcetype tuning, field extractions, and CIM normalization via props/transforms
- Build detection and reporting content — advanced SPL, data models, tstats, correlation searches, dashboards, reports, and alerts for technical and executive audiences
- Tune detections to reduce false positives and improve fidelity; develop threat-detection and log-correlation use cases aligned to SOC requirements
- Automate operations with Python, PowerShell, and Bash — log-ingestion validation, reporting, and compliance checks; SOAR/playbook automation a plus
- Support incident investigations using Splunk log, endpoint, and network telemetry; contribute to IR documentation and playbooks in coordination with the SOC
- Support endpoint security tooling (EDR/host-based monitoring), hardening and configuration validation, vulnerability-remediation tracking, patch validation, and audit evidence (POA&M)
Required Skills & Experience:
- 5+ years hands-on Splunk Enterprise and/or Splunk Cloud administration and engineering — building and operating a distributed environment, not just searching it
- Indexer/search-head clustering, deployment server and forwarder management, and Splunk configuration (indexes, inputs, props, transforms)
- Strong data onboarding and normalization — getting messy log sources into Splunk, parsed and CIM-compliant
- Fluent in advanced SPL; building dashboards, correlation searches, and alerts
- Scripting/automation in Python, PowerShell, and/or Bash
- Working knowledge of incident response, log correlation, threat detection, IDS/IPS, and EDR/host-based security tools
- Able to work on-site in Lower Manhattan 3 days per week
Preferred:
- Splunk Enterprise Certified Admin or Architect
- Splunk Enterprise Security (ES) content development
- Splunk SOAR / Phantom automation
- CISSP, CEH, GCIH, Security+, or equivalent
- Public sector / regulated-environment experience
Schedule: Monday–Friday, 9:00 AM – 5:00 PM (35-hour work week). Occasional off-hours or weekend support during production cutovers, upgrades, and deployments.
OZ Solutions Group is an equal opportunity employer.
Never miss an opportunity! Create an alert based on the job you applied for.