> Markdown version of [/jobs/ext/2450596-splunk-siem-engineer-5522-ts-sci-ft-meade-md](https://www.wearedevelopers.com/jobs/ext/2450596-splunk-siem-engineer-5522-ts-sci-ft-meade-md). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Splunk/SIEM Engineer (5522) (TS/SCI) (Ft. Meade, MD) - **Company:** SMX, LLC - **Location:** Fort Meade, MD, United States - **Experience:** Experienced - **Salary:** $160,000.0 - $190,000.0 - **Contract:** Permanent contract - **Skills:** Data Analysis, Bash Shell, Cyber Security, Data Loss, Disaster Recovery, Elasticsearch, Information Technology Operations, Python (Programming Language), Parsing, Performance Tuning, Logstash, SAP (Applications), Security Information and Event Management, Systems Architecture, Software Vulnerability Management, Backup and Restore, Scripting, Data Ingestion, System Availability, Indexer, Information Technology, Data Analytics, Kibana, Splunk - **Published:** August 9, 2026 - **Apply:** https://dejobs.org/x/x/FF173B68F5714DFE82F7FE8E03B5A37F/job/ ## About the Role * Active Top Secret (TS) security clearance with eligibility for SCI and NATO read-on before starting work (and willingness for SAP and CI Poly). * Certifications: * Splunk Enterprise Certified Architect * Security+ (or above) * Education * Bachelor's degree in computer science, Information Technology, or a similar field OR Minimum of 5 years of experience working with Splunk, including installation, configuration, and management. * Technical Skills * 2-3 years of experience an Elastic SIEM environment * Proficiency in managing Splunk components including forwarders, indexers, and search heads. * Strong understanding of SPL and the capacity to create custom dashboards and reports. * Experience in data parsing, field extraction, and indexing. Desired Skills/Experience * Experience transitioning a SIEM environment from Splunk to Elastic * Experience supporting Splunk Enterprise Security (ES) or IT Service Intelligence (ITSI). * Familiarity with scripting languages (e.g., Python, Bash) for automation. * Knowledge of security operations, including SIEM best practices. ## Description * SIEM Platform Migration (Splunk to Elastic) * Lead the end-to-end migration of the enterprise Security Information and Event Management (SIEM) capability from Splunk to the Elastic Stack (Elasticsearch, Logstash, Kibana), including planning, stakeholder coordination, execution, and post-migration validation to ensure zero degradation in security monitoring and detection coverage. * Develop and manage the migration roadmap and program schedule, defining phased cutover milestones, resource requirements, and risk mitigation strategies while ensuring parallel operation of both platforms during transition to maintain continuous threat detection and incident response readiness. * Splunk Implementation and Maintenance: * Set up and configure Splunk instances, including forwarders, indexers, and search heads. * Onboard new data sources into Splunk while ensuring proper parsing, field extraction, and indexing. * Manage Splunk licenses, user access controls, and configurations to maintain stability and security. * Data Analysis and Visualization: * Build and optimize dashboards, alerts, and reports for security monitoring, IT operations, and business use cases. * Develop and enhance Splunk Search Processing Language (SPL) queries to facilitate advanced analytics. * Collaborate with teams to ensure that data sources meet the requirements for analysis and visualization. * Troubleshooting and Performance Tuning: * Monitor the health of the Splunk system, identify issues, and implement solutions to maintain high availability and performance. * Optimize queries, alerts, and settings to lower resource use and improve efficiency. * Resolve data ingestion and indexing issues. * Service Level Agreement (SLA) Management and Monitoring: * * Maintain and monitor the Service Level Agreement (SLA) of the Splunk system, ensuring that the system meets the required uptime, performance, and data ingestion targets. * Monitor the ingest of data sources, particularly high-value or high-impact systems, and alert stakeholders when these systems stop sending events or experience disruptions. * Develop and implement monitoring dashboards and alerts to quickly identify and respond to SLA breaches or data ingest issues. * Disaster Recovery and High Availability: * Design and implement disaster recovery and high availability solutions for the Splunk system, ensuring minimal downtime and data loss in the event of a disaster or system failure. * Develop and maintain disaster recovery plans, including backup and restore procedures, to ensure business continuity. * Configure and manage Splunk clustering, replication, and indexing to ensure high availability and redundancy. * Compliance and Security: * Maintain RMF (Risk Management Framework) ATO (Authority to Operate) compliance for the Splunk system, ensuring that all security controls and configurations are in place and up-to-date. * Ensure STIG (Security Technical Implementation Guide) compliance for the Splunk system, including configuration and vulnerability management. * Maintain accurate and up-to-date documentation, including: * Data flow diagrams to illustrate data ingestion and processing. * Architecture diagrams to depict the Splunk system architecture. * System inventories to track hardware and software components. * Collaborate with the security team to ensure that the Splunk system meets all relevant security requirements and standards. * SIEM Management: * Manage the onboarding process for new systems and log types, including: * Maintaining onboarding documents for each system/log type. * Developing and maintaining a detailed list of event codes per operating system and application type. * Ensure that all data sources are properly configured and sending events to the Splunk system. * Collaborate with analysts and architects to develop and implement use cases for security monitoring and incident response. * Collaboration and Support: * Collaborate with architects and analysts to create and implement solutions that align with the organization's objectives. * Provide technical support and assist end users with Splunk-related issues, ensuring timely resolution and minimal downtime. * Documentation and Continuous Improvement: * Document the configurations, workflows, and troubleshooting procedures to enhance team knowledge sharing. * Research and suggest enhancements to Splunk infrastructure and analytics capabilities. ## Related Videos - [Debug a Kubernetes Operator](https://www.wearedevelopers.com/videos/487-debug-a-kubernetes-operator) - [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture) - [Optimizing Discovery: PostgreSQL's Role in Transforming GetYourGuide's Search](https://www.wearedevelopers.com/videos/1647-optimizing-discovery-postgresql-s-role-in-transforming-getyourguide-s-search) - [Better Together: Leveraging Your Observability Tools as a SIEM](https://www.wearedevelopers.com/videos/2118-better-together-leveraging-your-observability-tools-as-a-siem) - [Add Location-based Searching to Site with ElasticSearch](https://www.wearedevelopers.com/videos/77-add-location-based-searching-to-site-with-elasticsearch) - [Serverless Observability: where SLOs meet transforms](https://www.wearedevelopers.com/videos/854-serverless-observability-where-slos-meet-transforms) ## Related Articles - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [The Most Popular IT Jobs on the Market](https://www.wearedevelopers.com/magazine/376-the-most-popular-it-jobs-on-the-market) - [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents) - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs)