Job Title: Splunk Security Engineer
Location: Redmond, WA / Dallas, TX (Hybrid – 3 Days Onsite per Week)
Duration: 12+ Months
Bill Rate: $85/hr
Job Type: W-2, 1099, C2C
Client: To be Disclosed
Work Authorization: US Citizen, Green Card, OPT-EAD, CPT, H-1B, H4-EAD, Other

Job Description:

We are looking for an experienced Splunk Security Engineer with 7–8 years of experience in SIEM engineering, security monitoring, threat detection, and enterprise security operations. The candidate will be responsible for managing Splunk Enterprise and Splunk Enterprise Security platforms, integrating enterprise log sources, developing security dashboards, and implementing advanced threat detection solutions.

Roles and Responsibilities:

• Administer, configure, and maintain Splunk Enterprise and Splunk Enterprise Security (ES) platforms.
• Design and implement Splunk architecture, including deployment, configuration, and platform optimization.
• Onboard and integrate log sources from Windows, Linux, Active Directory, AWS, Azure, GCP, firewalls, EDR, IAM, and network security systems.
• Develop, maintain, and optimize SPL queries, dashboards, alerts, reports, and correlation searches.
• Configure log ingestion, parsing, normalization, indexing, and data retention policies.
• Troubleshoot log ingestion, parsing, indexing, CIM mapping, and data quality issues.
• Develop automated security monitoring solutions using SPL, Python, Bash, and SimpleXML.
• Design and implement detection rules and security use cases to improve threat detection capabilities.
• Perform proactive threat hunting using Splunk and security telemetry.
• Analyze security events and identify potential threats, vulnerabilities, and suspicious activities.
• Integrate threat intelligence feeds to improve security monitoring and detection.
• Conduct threat modeling using MITRE ATT&CK and Cyber Kill Chain frameworks.
• Collaborate with SOC and Incident Response teams during security investigations.
• Monitor Splunk performance and optimize search efficiency, indexing, and data retention.
• Support Splunk upgrades, migrations, deployment automation, and CI/CD activities.
• Prepare technical documentation and provide knowledge transfer to team members.

Required Skills:

• 7–8 years of experience in SIEM engineering and security monitoring.
• Strong hands-on experience with Splunk Enterprise and Splunk Enterprise Security.
• Expertise in SPL query development and troubleshooting.
• Experience onboarding and managing enterprise log sources.
• Strong knowledge of threat detection, threat hunting, and detection engineering.
• Experience developing and tuning SIEM alerts to reduce false positives.
• Strong understanding of Windows, Linux, networking, and cloud security.
• Knowledge of security operations, incident response, and threat intelligence.
• Familiarity with MITRE ATT&CK framework.