> Markdown version of [/jobs/ext/4280381-splunk-security-architect-es-soar](https://www.wearedevelopers.com/jobs/ext/4280381-splunk-security-architect-es-soar). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# SPLUNK SECURITY ARCHITECT (ES + SOAR)

- **Company:** Alchemy Global Networks LLC
- **Location:** United States (Remote available)
- **Experience:** Experienced
- **Salary:** $120,000 - $150,000
- **Contract:** Permanent contract
- **Skills:** Amazon Web Services, Data Analysis, Microsoft Azure, Cloud Computing, Cloud Computing Security, CompTIA Security+, Cyber Security, Identity and Access Management, Information Model, Network Security, Systems Integration, Scripting, Cloud Platform System, Computer Network Technologies, Data Ingestion, Firewalls (Computer Science), Juniper, Infrastructure Automation Frameworks, Enterprise Integration, Splunk, Cisco, Security Orchestration, Automation & Response, Microservices
- **Published:** October 27, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=629a999bf55fe1b2

## About the Role

* 5+ years of hands-on experience with Splunk Enterprise Security, including correlation searches, risk-based alerting, and notable event tuning.
 * 5+ years of experience integrating Splunk with endpoint, identity, firewall, and cloud security technologies.
 * Experience designing and developing SOAR playbooks using Splunk SOAR or a comparable automation platform.
 * 3+ years of Python scripting experience for security automation, custom integrations, or SOAR playbooks.
 * Experience administering and optimizing Splunk Cloud environments.
 * Hands-on experience with AWS or Microsoft Azure.
 * Strong knowledge of Splunk data ingestion, Technical Add-ons, HEC, forwarders, and CIM.
 * Experience troubleshooting search performance, managing resource utilization, and optimizing data ingestion.
 * Strong communication, analytical, and problem-solving skills.
 * Ability to work collaboratively with technical teams and federal stakeholders.
 * Must be eligible to obtain a Public Trust clearance.

Preferred Certifications

 * Splunk Enterprise Certified Architect
 * Splunk Enterprise Security Certified Admin
 * CompTIA Security+, CySA+, CISSP, or equivalent cybersecurity certification

Preferred Experience

 * Integration between Splunk Enterprise Security and SOAR platforms.
 * Experience with Cisco and Juniper networking technologies.
 * Familiarity with Cisco Secure Network Analytics (SNA).
 * Knowledge of microservices architecture and automation concepts.
 * Experience supporting federal civilian agencies.
 * Familiarity with the Risk Management Framework (RMF) and federal SOC reporting requirements.
 * Experience optimizing Splunk environments under resource or licensing constraints.

## Description

* Architect, implement, and optimize Splunk Enterprise Security solutions to support enterprise Security Operations Center (SOC) objectives.
 * Develop and tune correlation searches, risk-based alerting, and notable events to improve threat detection and reduce alert fatigue.
 * Design, develop, and maintain SOAR playbooks to automate security workflows and incident response processes.
 * Integrate Splunk with endpoint security, identity management, firewall, network, and cloud security technologies.
 * Manage data onboarding, including Technical Add-ons (TAs), HTTP Event Collector (HEC), forwarders, and Common Information Model (CIM) validation.
 * Optimize data ingestion and search performance to maintain compliance with Splunk Virtual Compute (SVC) entitlements.
 * Evaluate new data sources based on their operational value, security relevance, and impact on platform resources.
 * Utilize filtering, summarization, and federated search to improve platform efficiency.
 * Monitor indexing volumes, search workloads, and overall Splunk Cloud performance.
 * Collaborate with enterprise detection teams, security engineers, and other technical stakeholders.
 * Support security operations involving Cisco and Juniper network environments, including Cisco Secure Network Analytics (SNA).
 * Identify opportunities to improve security capabilities using existing tools and technologies.