Splunk Enterprise Security

Splunk Enterprise Security Cybersecurity Jobs

24 jobs found

10d ago

Sr. SecOps Security Engineer

Police and Fire Federal Credit Union Bensalem, PA

Bensalem, PA

10d ago

Full time Cybersecurity Tools Data Security Endpoint Security

Apply Now

Job Description

Police and Fire Federal Credit Union is hiring a Sr. SecOps Security Engineer reporting to the Manager SecOps for an onsite role in Bensalem, PA.

Responsibilities

Design, implement, and manage Splunk SIEM for centralized security monitoring, advanced threat detection, and incident response
Manage and monitor IDS/IPS systems and respond to suspicious activity
Deploy and maintain network-based DLP solutions and develop policies to support data privacy
Perform regular vulnerability assessments using tools such as Nessus and support remediation efforts
Deploy zero-day threat protection and develop response strategies
Manage endpoint protection technologies to help guard against malware
Implement identity and access management solutions including Okta and RSA
Architect and configure secure network solutions, including firewalls, NGFW, and Web Content Filtering
Maintain security architecture documentation and generate regular security posture reports
Collaborate with IT and compliance teams by providing guidance on security best practices
Work with IT and compliance teams to assess and reduce security risk and support regulatory compliance

Requirements

Bachelor’s degree in Computer Science, Information Technology, or a related field
5+ years of hands-on information security engineering and administration experience
Demonstrated technical knowledge of perimeter security devices and configuration
Proficiency in virtualized environments, including substantial experience with VMware and other virtualization technologies
Analytic ability and good judgment to assess problems and situations
Effective business communication and technical writing skills
In-depth knowledge of financial institution regulations, including NCUA, GLBA, and PCI DSS
In-depth working knowledge of network perimeter security technologies, including:
- Web Filter (ForcePoint)
- SIEM (Splunk)
- Intrusion Detection/Protection Systems
- Network-based DLP
- Vulnerability scanners (Nessus)
- Zero Day technologies (FireEye/Trellix)
- Email security technologies
- Cisco Secure Workload (CSW)
- Cisco Identity Services Engine (ISE)
- XDR solutions (Cisco AMP, Trellix, MS Defender)
- FireEye (NX and CMS)
- MFA (Okta and RSA)
- StealthWatch
Working knowledge of Security Risk Assessment Methodology, vulnerability analysis, and strong knowledge of SIEM technology (Splunk)
Monitor and maintain network security appliances to ensure system integrity from internal and external entities
Document current and future InfoSec systems configuration and changes following PFFCU change control guidelines
Tier 2 problem escalation contact including rotating afterhours support
Develop a working knowledge of the business side of PFFCU and interface effectively with other IT teams
Strong project skills, including completing multi-month projects while maintaining focus
Experience working with third-party service providers
Ability to handle multiple projects, prioritize tasks, and think logically while visualizing abstract concepts
Ability to communicate technical information clearly to stakeholders at all levels and with vendors
Ability to work varying hours, including evenings and weekends
Participation in an on-call rotation
Core hours: Monday-Friday, 8:00 AM – 4:00 PM

Technologies

Splunk
Firewalls, NGFW
Web Content Filtering, ForcePoint
Intrusion detection/protection systems
Data Loss Prevention, network-based DLP
Nessus
Zero-day threat protection, FireEye/Trellix
Endpoint protection technologies
Okta, RSA
Security Information and Event Management (SIEM)
Identity and access management (IAM) solutions
VMware, virtualization technologies
NetFlow Visibility
Zero Day platform
FireEye (NX and CMS)
StealthWatch
MFA (Okta and RSA)
Cisco Secure Workload (CSW)
Cisco Identity Services Engine (ISE)
XDR solutions (Cisco AMP, Trellix, MS Defender)

Benefits

Excellent medical, dental, vision benefits: 75% to 90% of premiums covered by PFFCU
401K: PFFCU contributes an automatic 6% after 1 year regardless of employee contribution

View full job page →

11d ago

Cybersecurity Engineer

Intellibee Richmond, VA

Richmond, VA

11d ago

Full time Cloud Platforms Cybersecurity Tools Endpoint Security

Apply Now

Job Description

The Cybersecurity Engineer will develop and implement advanced cyber defense capabilities while operating and enhancing a Splunk SIEM environment. This onsite role in Richmond, VA supports Splunk Enterprise Security for monitoring, detection, analysis, and response to security events, with emphasis on log analysis, threat hunting, incident response, and Splunk detection and compliance reporting.

Key Responsibilities

Continuously monitor network traffic, endpoint logs, and cloud security events to identify anomalous behavior and potential security incidents.
Create, maintain, and tune Splunk correlation searches, alerts, and dashboards to reduce false positives and strengthen detection coverage.
Investigate potential security incidents, follow forensic evidence, and coordinate with IT and network teams to remediate identified threats.
Develop and refine detection and response playbooks using threat intelligence and frameworks such as MITRE ATT&CK.
Partner with infrastructure teams to onboard new data sources, ensuring log integrity, parsing, and normalization within the SIEM platform.
Support audit readiness by collecting SIEM control evidence and producing compliance reports aligned with internal policies and standards.

Required Qualifications

8+ years of hands-on cybersecurity experience, specifically operating, building, and investigating threats within a SIEM or Splunk environment.
Excellent critical thinking, problem-solving, and communication skills, including the ability to manage multiple security tickets and operate calmly under pressure.
Proficiency writing SPL (Splunk Processing Language).
Strong understanding of networking, firewalls, EDR, and cloud platforms such as AWS, Azure, or GCP.
Knowledge of security frameworks (for example, MITRE ATT&CK) and security compliance standards such as NIST, HIPAA, or SOC 2.
Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related field.
Relevant certifications such as Splunk Core Certified User and Splunk Core Certified Advanced Power User are highly preferred.

Technologies and Tools

Splunk SIEM
Splunk Enterprise Security
Splunk Processing Language (SPL)
MITRE ATT&CK
AWS, Azure, GCP
NIST, HIPAA, SOC 2
EDR

Benefits

Long-Term Stability: Multi-year opportunities with room to grow.
Comprehensive Health Coverage: Healthcare benefits for you and your family.
401(k) Program: Retirement savings with future planning support.
GC Assistance: Support for immediate Green Card processing, if required.

Education

Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related field.

View full job page →

11d ago

Security Engineer III, Splunk Architect

Deloitte Arlington, VA

Arlington, VA

11d ago

$103k - $189k/yr Full time Cloud Platforms Cybersecurity Tools Data Security

Apply Now

Job Description

Deloitte is seeking a Security Engineer III, Splunk Architect to design, implement, and optimize Splunk solutions for security monitoring, visibility, and enterprise logging strategies. The position blends hands-on engineering with architecture responsibilities to support threat detection, incident response, and compliance monitoring within a cybersecurity-focused team.

Responsibilities

Design, implement, and optimize Splunk architectures to enable security monitoring, log management, and operational analytics.
Develop and maintain Splunk dashboards, alerts, reports, searches, and data models based on client and business requirements.
Integrate data sources into Splunk, including infrastructure, cloud, application, and security technologies.
Support development of security use cases spanning threat detection, incident response, compliance monitoring, and operational visibility.
Create and maintain architecture diagrams, technical documentation, implementation standards, and administration procedures.

Requirements

Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical field.
Active Top-Secret Clearance.
Ability to work onsite up to 5 days a week.
2+ years of experience implementing and supporting Splunk Enterprise or Splunk Cloud.
2+ years of experience developing Splunk dashboards, reports, alerts, and saved searches.
Experience onboarding and normalizing log sources from infrastructure, applications, cloud platforms, or security tools.
Understanding of SIEM concepts, security monitoring, or threat detection use cases.
Working knowledge of TCP/IP, networking protocols, and system log analysis.
Experience with Splunk Search Processing Language (SPL), Splunk data models, and role-based access controls.
One or more of the following certifications: Splunk Core Certified Power User, Splunk Enterprise Certified Admin, or Splunk Enterprise Security.
Ability to travel 20% on average based on client needs and sectors.
Legal authorization to work in the United States without employer sponsorship, now or in the future.

Technologies

Splunk Enterprise, Splunk Cloud
Splunk Search Processing Language (SPL)
Splunk dashboards, Splunk data models
Transmission Control Protocol/Internet Protocol (TCP/IP)
SIEM
Python
AWS, Microsoft Azure, Google Cloud Platform (GCP)
Splunk Enterprise Security, Splunk SOAR

Preferred

1+ year of experience supporting Splunk in AWS, Microsoft Azure, or GCP.
5+ years of experience with Splunk Enterprise Security, Splunk SOAR, or security orchestration workflows.
5+ years of experience integrating Splunk with endpoint, identity, firewall, or cloud security tools.
1+ year of experience with Python, automation scripting, or infrastructure as code tools.
Experience supporting regulated or federal environments.

Skills for Success

Ability to work independently and collaborate as part of a team.
Effective written and verbal communication skills.
Meticulous attention to detail and quality of work product.
Ability to build and sustain professional relationships.
Ability to lead projects or workstreams.
Ability to manage and prioritize multiple tasks in a fast-paced, dynamic environment.
Strong interpersonal skills and professional demeanor.
Ability to meet deadlines and provide clear guidance to others.

Team

Deloitte’s Cyber team supports businesses with the unique challenges and opportunities in cybersecurity.
Cyber Defense & Resilience helps clients defend against advanced threats by transforming security operations, monitoring technology, data analytics, and threat intelligence.
The offering helps manage and protect dynamic attack surfaces and supports rapid crisis and cyber incident response, enabling clients to be ready for, respond to, and recover from business disruptions.

Location and Pay

Arlington, VA (onsite). Salary range: USD 102,500 - 188,900 per year. Minimum experience: 2 years.

View full job page →

12d ago

Cybersecurity Engineer

Skywalk Global Richmond, VA

Richmond, VA

12d ago

Full time Cloud Platforms Cloud Security Cyber Forensics

Apply Now

Job Description

Richmond, VA (onsite) role focused on Splunk SIEM operations, detection engineering, and incident investigation.

Responsibilities

Continuously review network traffic, endpoint logs, and cloud security events to identify anomalies and potential incidents
Build, maintain, and tune Splunk correlation searches, alerts, and dashboards to reduce false positives and strengthen detection quality
Investigate potential incidents using forensic evidence and coordinate with IT and network teams to remediate threats
Create and refine detection and response playbooks informed by threat intelligence and frameworks such as MITRE ATT&CK
Partner with infrastructure teams to onboard new data sources, ensuring log integrity, parsing, and normalization across the SIEM platform
Support audit readiness by collecting SIEM control evidence and producing compliance reports aligned with internal policies and standards

Requirements

Minimum 8+ years hands-on cybersecurity experience operating, building, and investigating threats within a SIEM or Splunk
Critical thinking, problem-solving, and communication skills; able to operate calmly under pressure and manage multiple security tickets
Proficiency writing SPL (Splunk Processing Language)
Strong understanding of networking, firewalls, EDR, and cloud platforms including AWS, Azure, or GCP
Knowledge of security frameworks such as MITRE ATT&CK and security compliance standards including NIST, HIPAA, or SOC 2
Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related field
Relevant certifications such as Splunk Core Certified User and Splunk Core Certified Advanced Power User (highly preferred)

Technologies

Splunk SIEM
Splunk Enterprise Security
SPL (Splunk Processing Language)
Splunk correlation searches
MITRE ATT&CK
AWS, Azure, GCP
EDR
NIST, HIPAA, SOC 2

View full job page →

14d ago

Principal Cybersecurity Analyst

UnitedHealth Group Raleigh, NC

Raleigh, NC

14d ago

$113k - $193k/yr Full time Senior Cloud Platforms Cybersecurity Tools

Apply Now

Job Description

In Raleigh, NC with a hybrid work arrangement, enjoy a competitive salary range of USD 112,700 to 193,200 per year, plus a robust benefits package that includes incentive and recognition programs, equity stock purchase opportunities, and 401k contributions. UnitedHealth Group’s Optum Technology Cyber Defense team invites you to lead the design and implementation of Splunk SOAR playbooks and AI powered automation to elevate cybersecurity operations, collaborating closely with Cyber Defense, SOC, and incident response teams.

Responsibilities

Architect, build, and sustain Splunk SOAR playbooks, automations, and custom actions to streamline security operations
Convert complex security operations and incident response needs into scalable, resilient automation solutions
Seamlessly integrate SOAR workflows with security tools, APIs, and enterprise platforms
Design and deploy AI-powered defenses addressing complex cyber challenges while emphasizing responsible AI use
Collaborate with Cyber Defense, SOC, and incident response teams to proactively identify automation opportunities and optimize workflows
Leverage enterprise-approved AI tools to automate repetitive tasks and drive ongoing process improvements
Provide senior technical leadership, mentor analysts, and contribute to automation standards, reusable frameworks, and industry best practices
Evaluate emerging technology trends, including AI advancements, to inform solution design and strategic innovation

Requirements

6+ years of Python development experience
6+ years of cybersecurity experience
Hands-on Splunk SOAR experience, including development of custom applications and actions
Proficiency in Python, API integrations, and automation design
Experience with GitHub and project/work tracking tools such as GitHub Projects
Working knowledge of cloud platforms (AWS, Azure, and GCP)
Proven ability to translate ambiguous or complex requirements into scalable technical solutions

Technologies

Splunk SOAR, Splunk Enterprise Security (ES)
Splunk SPL, Python
GitHub, AWS, Azure, GCP
APIs

Benefits

Comprehensive benefits package
Incentive and recognition programs
Equity stock purchase
401k contribution

Preferred Qualifications

Bachelor's degree in Cybersecurity, Computer Science, or a related technology field (or equivalent professional experience)
Experience with Splunk Enterprise Security (ES) and Splunk SPL
Experience with CI/CD and source control practices for security automation content
Experience creating reusable automation frameworks
Experience with AI agents, LLM-integrated workflows, or AI-assisted analyst workflows
Familiarity with AI governance concepts, including approval workflows, guardrails, and human-in-the-loop design

Application Deadline

This posting will remain active for a minimum of 2 business days or until a sufficient candidate pool is gathered. The posting may close early due to volume of applicants.

View full job page →

14d ago

Cybersecurity Analysts with Active TS/SCI clearance

APR Consulting Inc Tampa, FL

Tampa, FL

14d ago

$62+/hr Contract Analytics Cybersecurity Tools Endpoint Security

Apply Now

Job Description

APR Consulting, Inc. supports a world-leading aerospace innovator in Tampa by sourcing a Cybersecurity Analyst with an active TS/SCI clearance. This role centers on Splunk SIEM operations and HBSS/Trellix endpoint protection within a high-security environment, operating on a Panama 12-hour shift schedule under a contract of three months or longer. The position is onsite in Tampa and demands a solid background in security analytics and SIEM administration.

Responsibilities

Create and optimize Splunk queries to extract, analyze, and visualize security data from diverse sources.
Apply Splunk SPL to generate actionable insights for proactive threat detection and response.
Design user-friendly Splunk dashboards and reports for security operations, management, and auditors.
Provide real-time visibility into security events, trends, and key performance indicators.
Configure and fine-tune Splunk deployments, including data inputs, parsing, field extractions, and enrichment pipelines.
Ensure continuous availability and optimal performance of Splunk indexes, search heads, and forwarders.
Leverage Splunk Enterprise Security to develop and implement security use cases, correlation searches, and notable events.
Monitor security-related alerts and incidents to identify and prioritize threats.
Utilize Trellix Endpoint Security Solutions (HBSS) to detect and counter known threats.
Collaborate with IT, network, and application teams to integrate Splunk with various platforms and systems.
Provide technical guidance on security best practices and design effective controls.
Investigate security incidents using Splunk for forensic analysis, perform root cause analysis, and conduct post-incident reviews.
Document Splunk configurations, procedures, and security findings; prepare comprehensive reports.
Communicate technical information effectively to non-technical stakeholders.
Stay current with cybersecurity threats, vulnerabilities, and industry best practices; pursue ongoing Splunk training and certifications.
Apply solid SIEM concepts and troubleshoot Splunk configurations and performance issues.
Collaborate with cross-functional teams to investigate incidents and provide insights to improve security posture.

Requirements

US Citizen required
Current/active DoD TS/SCI clearance
DoD 8570 Certification for IAT Level II or higher prior to start date
Bachelor’s degree with 2 years of experience
Experience with a Security Information and Event Management (SIEM) tool
Ability to collaborate with other teams to investigate security incidents and improve security posture
Working knowledge of network security controls such as routers, switches, firewalls and network access controls
Working knowledge of Linux and Windows operating systems
Knowledge of vulnerabilities, threat detection, encryption, and security audits
Willing to work a Panama schedule that includes 12-hour shifts

Technologies

Splunk
Splunk SPL (Search Processing Language)
Splunk Enterprise Security
Trellix Endpoint Security Solutions (HBSS)

Location

Tampa, FL 33609 (Onsite)

Pay Rate

$62.10/hr on W2 (DOE)

Duration

3 months or longer

Schedule

Panama schedule that includes 12-hour shifts, with a three-day weekend every other week and rotation from days to nights approximately every 12 weeks.

About Our Client

The client is a world leader and premier aerospace innovator, employing over 100,000 professionals delivering advanced products and technologies. The organization has earned numerous awards and recognitions and supports ongoing growth and development for its staff.

About APR

Since 1980 APR Consulting, Inc. has provided professional recruiting and contingent workforce solutions to a diverse mix of clients, industries, and skill sets nationwide.

View full job page →

15d ago

Security Engineer

GuidePoint Security Denver, CO 🇺🇸 Remote

Denver, CO

15d ago

$140k - $170k/yr Full time Cybersecurity Tools Endpoint Security Engineer

Apply Now

Job Description

Join GuidePoint Security's Denver Heartland team as a Security Engineer, delivering hands-on network security work and collaborating with clients to advance security outcomes. This role blends practical delivery with client-facing advisory as you grow toward broader security strategy.

Responsibilities

Provide technical support and guidance to Heartland clients, delivering hands-on security delivery, design guidance, and best practices in the network security domain
Partner with the sales team to scope solutions, conduct technical discovery, and present architectures that align with client business objectives
Develop deep expertise in network security platforms and translate technical capabilities into strategic outcomes for customers
Foster trusted advisor relationships with client stakeholders through empathy, active listening, and a commitment to solving their security challenges
Produce clear documentation such as security assessments, architecture recommendations, and implementation guides
Continuously expand knowledge across adjacent security domains to evolve into a well-rounded security strategist
Embrace emerging technologies, including AI tools, to work smarter, solve problems, and drive better business outcomes

Requirements

Network security foundation with hands-on experience in zero trust architecture, next-generation firewalls, AppID, micro-segmentation, and secure access concepts
Proven experience with firewall and network security platforms such as Palo Alto Networks, Check Point, and Fortinet
Ability to troubleshoot common network security issues on platforms including firewalls, routing, NAT, and VPN
Proficiency across operating systems including Windows, macOS, and Linux
Working knowledge of core security concepts aligned with CISSP domains (you don’t need the certification, but you understand the landscape)
Strong written and verbal communication skills for producing security incident reports, performance notes, and recommendations
Education: Bachelor's degree or equivalent professional experience

Technologies

Palo Alto Networks, Checkpoint, Fortinet
Windows, macOS, Linux
CrowdStrike, SentinelOne, Zscaler
Microsoft Defender, Carbon Black, Splunk
Cisco security products
AI tools

Benefits

Remote work primarily within the United States, with some roles requiring travel or on-site presence for Federal positions
Group medical insurance options, including a Zero Deductible PPO plan (GuidePoint covers 90% of employee premiums and 70% of family plans) or a High Deductible Health Plan with an HSA (GuidePoint covers 100% of employee premiums and 75% of family plans; HDHP/HSA contributions in four quarterly installments)
Group dental insurance with GuidePoint paying 100% of the employee premium and 75% of family plans
12 corporate holidays and a Flexible Time Off program
Mobile phone and home internet stipend
Retirement plan eligibility after two months during open enrollment
Pet Benefit Option

Who you are

Relentless curiosity: you probe why and what if, seeking to understand systems end-to-end
Growth mindset: you view every engagement as a chance to learn and improve
Emotional intelligence: you deliver security guidance with empathy, patience, and audience awareness
Problem-solving drive: you approach challenges with creativity and persistence
Aptitude over perfection: you can move quickly toward answers even when not everything is known
Ownership and autonomy: you manage multiple priorities and deliver results without micromanagement

Where this role takes you

Network security delivery
Client-facing support
Technical documentation
Platform expertise
Pre-sales leadership
Solution architecture
Business advisory
Enterprise influence

SOME ADDED PERKS

Remote workforce primarily (U.S. based, some travel may be required; on-site may be required for Federal positions)
Group medical insurance options: Zero Deductible PPO plan (employee premiums covered at 90%, family plans at 70%) or High Deductible Health Plan with HSA (employee premiums covered at 100%, family plans at 75%); HDHP/HSA contributions quarterly
Group dental insurance: 100% of employee premium and 75% of family plans
12 corporate holidays and a Flexible Time Off program
Healthy mobile phone and home internet allowance
Retirement plan eligibility after two months at open enrollment
Pet Benefit Option