> Markdown version of [/jobs/ext/2606085-splunk-enterprise-security-es-consultant](https://www.wearedevelopers.com/jobs/ext/2606085-splunk-enterprise-security-es-consultant). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Splunk Enterprise Security (ES) Consultant...

- **Company:** System One
- **Location:** Arlington, WI, United States (Remote available)
- **Contract:** Permanent contract
- **Skills:** Bash Shell, Software Debugging, Linux, Perl (Programming Language), Information Model, Python (Programming Language), Regular Expressions, Security Information and Event Management, Data Streaming, Scripting, Data Ingestion, Information Technology, Splunk
- **Published:** August 7, 2026
- **Apply:** https://www.juju.com/job/00000000gm08ij

## About the Role

+ Several years of hands-on Splunk experience, with real ES implementation, content development, and tuning

 + Strong SPL and regular expressions

 + Scripting in Python, Perl, or Bash

 + Solid grasp of CIM and data onboarding and normalization at scale

 + Experience supporting clustered Splunk environments in SOC or NOC settings

 + SIEM data modeling experience on a platform at scale

 + Proficiency in Linux, including editing and maintaining Splunk config files and apps

 + Comfortable working consultatively with client teams and explaining the why behind the work

 + Splunk certifications (Core Certified Consultant, ES Certified Admin, Architect) are a plus but not required

 + Demonstrated ES delivery experience carries more weight than paper

## Description

+ Develop custom detection content: correlation searches, notable events, alerts, reports, and visualizations to surface threat activity

 + Build and maintain Splunk Apps and Technology Add-ons (TAs)

 + Onboard new data sources and normalize them to the Common Information Model (CIM)

 + Optimize data flow and ingestion using aggregation, filtering, and pipeline tuning

 + Configure notable event actions, action menus, and Adaptive Responses

 + Tune detections to cut noise and surface what matters, including risk-based alerting where applicable

 + Build dashboards that highlight anomalies, trends, and security and operational metrics

 + Support and optimize large distributed clustered Splunk environments (search heads, indexers, forwarders, deployment servers)

 + Partner with the client's security and SOC teams, debug complex integration and configuration issues

 + Document processes, procedures, and key engineering decisions, System One, and its subsidiaries including Joulé, ALTA IT Services, CM Access, TPGS, and MOUNTAIN, LTD., are leaders in delivering workforce solutions and integrated services across North America. We help clients get work done more efficiently and economically, without compromising quality. System One not only serves as a valued partner for our clients, but we offer eligible full-time employees health and welfare benefits coverage options including medical, dental, vision, spending accounts, life insurance, voluntary plans, as well as participation in a 401(k) plan.


## Related Videos

- [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java)
- [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture)
- [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker)
- [Add Location-based Searching to Site with ElasticSearch](https://www.wearedevelopers.com/videos/77-add-location-based-searching-to-site-with-elasticsearch)
- [Intermediate Bitcoin Script](https://www.wearedevelopers.com/videos/25-intermediate-bitcoin-script)
- [Better Together: Leveraging Your Observability Tools as a SIEM](https://www.wearedevelopers.com/videos/2118-better-together-leveraging-your-observability-tools-as-a-siem)

## Related Articles

- [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)
- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents)