> Markdown version of [/jobs/ext/1800994-lead-engineer-it-security-siem-splunk](https://www.wearedevelopers.com/jobs/ext/1800994-lead-engineer-it-security-siem-splunk). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Lead Engineer, IT Security (SIEM/Splunk) - **Company:** Raymond James Financial, Inc. - **Location:** St. Petersburg, FL, United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Application Programming Interfaces (APIs), Artificial Intelligence, Data Analysis, User Authentication, Bash Shell, Cloud Computing, Cyber Security, Computer Engineering, Continuous Integration, Linux, Distributed Systems, Intrusion Detection and Prevention, Information Systems Security Architecture Professional, Python (Programming Language), Network Protocols, Parsing, Performance Tuning, Windows PowerShell, Security Information and Event Management, Syslog, Systems Integration, Test Data, Scripting, Computer Network Operations, Cloud Platform System, Macros, Data Ingestion, Postman, System Availability, Cyber Threat Analysis, Indexer, Infrastructure Automation Frameworks, Information Technology, Cybercrime, Splunk, Api Management, Cisco - **Published:** July 2, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=999ea2a9c16b2881 ## About the Role * B.S. in Computer Science, Computer Engineering, or related degree and a minimum of five (5) years of related experience in Splunk engineering, administration, and content development * System administrator experience in Linux, Windows, or OSX operating systems * System administrator experience in maintenance and management of enterprise syslog environment * Knowledge of networking and the common network protocols * Experience with development of complex Splunk analytics * Familiar with interacting with a variety of APIs and using an API platform such as Postman, Insomnia, or Hopscotch to develop and test data integrations * Demonstrated ability to create complex scripts, develop tools, or automate processes in PowerShell, Python or Bash. * One or more of the following certifications or the ability to obtain within 1 year: + Splunk Cloud Certified Admin + Splunk Certified Architect + Splunk Certified Consultant + CISSP: Certified Information Systems Security Professional + CCNA: Cisco Certified Network Associate Competencies: * Analysis: Identify and understand issues, problems and opportunities; compare data from different sources to draw conclusions. * Communication: Clearly convey information and ideas through a variety of media to individuals or groups in a manner that engages the audience and helps them understand and retain the message. * Exercising Judgment and Decision Making: Use effective approaches for choosing a course of action or developing appropriate solutions; recommend or take action that are consistent with available facts, constraints, and probable consequences. * Technical and Professional Knowledge: Demonstrate a satisfactory level of technical and professional skill, or knowledge, in position-related areas; remain current with developments and trends in areas of expertise. * Building Effective Relationships: Develop and use collaborative relationships to facilitate the accomplishment of work goals. * Client Focus: Make internal and external clients, and their needs, a primary focus of actions; develop and sustain productive client relationships. Education Bachelor's, High School (HS) (Required) ## Description Analyzes and monitors the organization's cyber security measures; responds to actual penetration attempts by malicious hackers., This position follows our hybrid workstyle policy: Expected to be in a Raymond James office location a minimum of 12 days a month. Please note: This role is not eligible for Work Visa sponsorship, either currently or in the future. The financial services industry is constantly under attack by sophisticated cyber adversaries that range from nation states to criminals. In response, the Raymond James Cyber Threat Center (CTC) is charged with ensuring all equities are secure against all tiers of adversaries. We are the central hub for Computer Network Operations and are on the front lines of security incident response, threat hunting, and intelligence. You'll be working with emerging technologies to solve challenging security problems in a fast-paced and continuously evolving environment, while helping steer the direction and evolution of the team. This highly visible team within the organization evaluates threats to the environment and dynamically adjusts to the ever-changing threat landscape by applying practical security knowledge to developing new detective measures to protect the firm. The CTC Lead Engineer, IT Security, is a primary member of the CTC and serves as a Splunk subject matter expert responsible for the design, development, creation, and maintenance of advanced Splunk content in support of Incident Response, HUNT, Cyber Threat Intelligence, and Cyber Crime operations. This role provides technical leadership for Splunk engineering, administration, optimization, automation, and AI-enabled security analytics across the enterprise. The Lead Engineer is also part of the Raymond James Splunk administration team and is responsible for the operation and maintenance of the Raymond James Splunk Cloud environment, including search heads, indexers, heavy and universal forwarders, and the enterprise Syslog-NG environment. The role partners closely with security operations, threat detection, incident response, infrastructure, cloud, and application teams to ensure reliable log ingestion, scalable platform performance, actionable detections, and continuous improvement through automation, analytics, and AI-assisted capabilities. Responsibilities: * Lead the architecture, engineering, administration, and ongoing optimization of Splunk Cloud across a large-scale, distributed, hybrid, environment * Responsible for Splunk Cloud platform health, including indexer/search head clustering, deployment servers, forwarder management, storage optimization, license utilization, retention policies, performance tuning, and system availability * Develop, tune, and maintain Splunk content, including dashboards, reports, alerts, correlation searches, data models, field extractions, props/transforms, lookups, macros, and CIM-aligned knowledge objects * Lead automation initiatives across Splunk and security operations, including automated log onboarding, health checks, evidence collection, and ticket creation * Work with SOAR platforms, scripting, APIs, CI/CD pipelines, and infrastructure-as-code practices to automate repeatable Splunk administration, content management, and operational workflows * Troubleshoot complex Splunk issues related to ingestion, parsing, indexing, searching, acceleration, dashboards, apps/add-ons, authentication, integrations, storage, and platform performance * Lead administration and operational support for the global Syslog-NG environment * Strong troubleshooting skills across Linux, Windows, networking, storage, authentication, distributed systems, and cloud environments. * Shares in a weekly on-call rotation and acts as an escalation point for major incidents and associates of Raymond James. ## Related Videos - [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture) - [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) - [How Cisco embraced a DevOps culture within its network engineering team](https://www.wearedevelopers.com/videos/99-how-cisco-embraced-a-devops-culture-within-its-network-engineering-team) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Docker exec without Docker](https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers) - [What’s the Difference between a Junior, Mid, and Senior Developer?](https://www.wearedevelopers.com/magazine/238-what-s-the-difference-between-a-junior-mid-and-senior-developer) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)