SPLUNK SECURITY ARCHITECT (ES + SOAR)

• Architect, implement, and optimize Splunk Enterprise Security solutions to support enterprise Security Operations Center (SOC) objectives.
• Develop and tune correlation searches, risk-based alerting, and notable events to improve threat detection and reduce alert fatigue.
• Design, develop, and maintain SOAR playbooks to automate security workflows and incident response processes.
• Integrate Splunk with endpoint security, identity management, firewall, network, and cloud security technologies.
• Manage data onboarding, including Technical Add-ons (TAs), HTTP Event Collector (HEC), forwarders, and Common Information Model (CIM) validation.
• Optimize data ingestion and search performance to maintain compliance with Splunk Virtual Compute (SVC) entitlements.
• Evaluate new data sources based on their operational value, security relevance, and impact on platform resources.
• Utilize filtering, summarization, and federated search to improve platform efficiency.
• Monitor indexing volumes, search workloads, and overall Splunk Cloud performance.
• Collaborate with enterprise detection teams, security engineers, and other technical stakeholders.
• Support security operations involving Cisco and Juniper network environments, including Cisco Secure Network Analytics (SNA).
• Identify opportunities to improve security capabilities using existing tools and technologies.

• 5+ years of hands-on experience with Splunk Enterprise Security, including correlation searches, risk-based alerting, and notable event tuning.
• 5+ years of experience integrating Splunk with endpoint, identity, firewall, and cloud security technologies.
• Experience designing and developing SOAR playbooks using Splunk SOAR or a comparable automation platform.
• 3+ years of Python scripting experience for security automation, custom integrations, or SOAR playbooks.
• Experience administering and optimizing Splunk Cloud environments.
• Hands-on experience with AWS or Microsoft Azure.
• Strong knowledge of Splunk data ingestion, Technical Add-ons, HEC, forwarders, and CIM.
• Experience troubleshooting search performance, managing resource utilization, and optimizing data ingestion.
• Strong communication, analytical, and problem-solving skills.
• Ability to work collaboratively with technical teams and federal stakeholders.
• Must be eligible to obtain a Public Trust clearance.

Preferred Certifications

• Splunk Enterprise Certified Architect
• Splunk Enterprise Security Certified Admin
• CompTIA Security+, CySA+, CISSP, or equivalent cybersecurity certification

Preferred Experience

• Integration between Splunk Enterprise Security and SOAR platforms.
• Experience with Cisco and Juniper networking technologies.
• Familiarity with Cisco Secure Network Analytics (SNA).
• Knowledge of microservices architecture and automation concepts.
• Experience supporting federal civilian agencies.
• Familiarity with the Risk Management Framework (RMF) and federal SOC reporting requirements.
• Experience optimizing Splunk environments under resource or licensing constraints.

• 401(k)
• Dental insurance
• Flexible spending account
• Health insurance
• Health savings account
• Life insurance
• Paid time off
• Retirement plan