SEIM Engineer

The Commonwealth of Pennsylvania is seeking a SIEM Engineer to provide specialized engineering support for its enterprise Security Information and Event Management (SIEM) environment. The role focuses on designing, configuring, integrating, optimizing, and maintaining SIEM capabilities to strengthen security monitoring, threat detection, incident response, and log management., * Engineer, configure, maintain, and optimize the enterprise SIEM platform, including Splunk.

• Onboard data sources and ensure logs are properly collected, parsed, normalized, indexed, and retained.
• Develop and maintain correlation searches, alerts, dashboards, reports, and detection rules.
• Integrate SIEM capabilities with security tools, cloud platforms, applications, and infrastructure.
• Monitor platform performance, capacity, availability, and overall health.
• Tune alerts and detection logic to improve monitoring effectiveness and reduce false positives.
• Support SOC analysts and incident response teams with queries, dashboards, and investigative capabilities.
• Support SIEM upgrades, patches, configuration changes, testing, and implementation.
• Maintain technical documentation, operational procedures, and knowledge-transfer materials.
• Collaborate with SOC, infrastructure, cloud, networking, and application teams.
• Follow Commonwealth security standards, change-management processes, and cybersecurity policies.

Primary Skills SIEM, Splunk Enterprise, Splunk Enterprise Security, SPL, Security Engineering, Cybersecurity Operations, Log Management, Syslog, APIs, Cloud-Native Integrations, Threat Detection, Incident Response, Security Monitoring, NIST, MITRE ATT&CK

• 3+ years of professional IT experience in SIEM, security engineering, cybersecurity operations, or security monitoring.
• 3+ years of experience administering or engineering Splunk Enterprise and/or Splunk Enterprise Security.
• 3+ years of experience onboarding and integrating security log sources using syslog, APIs, agents, or cloud-native integrations.
• Experience developing SPL searches, dashboards, alerts, correlation searches, and reports.
• Strong troubleshooting skills across SIEM platforms, log ingestion, and integrations.
• Knowledge of cybersecurity frameworks such as NIST and MITRE ATT&CK.

Preferred Qualifications

• Splunk Enterprise Certified Admin certification.
• Experience supporting large enterprise or government environments.
• Experience optimizing SIEM detection rules and reducing false positives.