Splunk

Splunk Cybersecurity Jobs

50 jobs found

Today

Security Engineer III, Splunk Architect

Deloitte Rosslyn, VA

Rosslyn, VA

Today

$103k - $189k/yr Full time Analytics Cloud Platforms Cybersecurity Tools

Apply Now

Job Description

Deloitte is seeking a Splunk Architect to design and optimize Splunk-based security monitoring and enterprise logging capabilities for the Cyber team.

Responsibilities

Design, implement, and optimize Splunk architectures for security monitoring, log management, and operational analytics
Develop and maintain Splunk dashboards, alerts, reports, searches, and data models based on client and business requirements
Integrate data sources into Splunk, including infrastructure, cloud, applications, and security technologies
Support use case development across threat detection, incident response, compliance monitoring, and operational visibility
Create and maintain architecture diagrams, technical documentation, implementation standards, and administration procedures

Requirements

Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical field
Active Top-Secret Clearance
Ability to work onsite up to 5 days per week (Rosslyn, VA)
2+ years experience in one or more of the following:
- Implementing and supporting Splunk Enterprise or Splunk Cloud
- Developing Splunk dashboards, reports, alerts, and saved searches
- Onboarding and normalizing log sources from infrastructure, applications, cloud platforms, or security tools
- SIEM concepts, security monitoring, or threat detection use cases
- Working knowledge of TCP/IP, networking protocols, and system log analysis
- Experience with Splunk Search Processing Language (SPL), data models, and role-based access controls
One or more certifications: Splunk Core Certified Power User, Splunk Enterprise Certified Admin, or Splunk Enterprise Security
Ability to travel 20% on average based on work, clients, and industries/sectors served
Legally authorized to work in the United States without employer sponsorship, now or in the future

Technologies

Splunk Enterprise, Splunk Cloud
Splunk Search Processing Language (SPL)
SIEM
Splunk dashboards, Splunk alerts, Splunk reports, saved searches
Splunk data models
Role-based access controls
Splunk SOAR
Python
AWS, Microsoft Azure, Google Cloud Platform (GCP)
Transmission Control Protocol/Internet Protocol (TCP/IP)
Infrastructure as code

Preferred

1+ year experience supporting Splunk in AWS, Microsoft Azure, or GCP
5+ years experience with Splunk Enterprise Security, Splunk SOAR, or security orchestration workflows
5+ years experience integrating Splunk with endpoint, identity, firewall, or cloud security tools
1+ year experience with Python, automation scripting, or infrastructure as code tools
Experience supporting regulated or federal environments

Compensation

$102,500 - $188,900 per year (estimated wage range)

Incentive Program

Eligible for a discretionary annual incentive program, subject to program rules
Any award depends on factors including individual and organizational performance

View full job page →

Today

Security Engineer III, SIEM Engineer

Deloitte Rosslyn, VA 🇺🇸 Remote

Rosslyn, VA

Today

$103k - $189k/yr Full time Crowdstrike Cybersecurity Analysis Cybersecurity Integration

Apply Now

Job Description

Deloitte Cyber Defense and Resilience is seeking a SIEM Engineer to strengthen security monitoring and detection engineering across complex enterprise environments. The role supports incident analysis and improves alert fidelity through well-tuned SIEM content and reliable log integration.

Responsibilities

Configure, maintain, and optimize SIEM content, including correlation rules, alerts, dashboards, and reports
Analyze security events and log data to identify suspicious activity, support investigations, and expand detection coverage
Integrate and normalize log sources from endpoint, network, cloud, identity, and security platforms
Partner with cybersecurity teams to support use case development, threat detection, incident triage, and response activities
Document detection logic, operational procedures, and monitoring requirements to support consistent service delivery

Required Qualifications

Bachelor's degree in computer science, cybersecurity, information technology, engineering, or a related technical field
Active Secret Clearance
3+ years of experience in cybersecurity, security operations, or SIEM engineering
3+ years of experience with at least one of the following: Splunk, Palo Alto XSIAM, or CrowdStrike NG SIEM
2+ years experience in:
- Creating, tuning, and maintaining correlation searches, alerts, dashboards, and reports in a Security Information and Event Management platform
- Reviewing and analyzing logs from endpoint, network, cloud, identity, and application sources
Security certification such as Splunk certification, Palo Alto Networks certification, or CrowdStrike certification is required
Ability to travel up to 20%, on average
Willingness to work at client onsite or Deloitte office up to 5 days a week
Legally authorized to work in the United States without employer sponsorship, now or in the future

Technologies

Splunk
Palo Alto XSIAM
CrowdStrike NG SIEM
Splunk certification
Palo Alto Networks certification
CrowdStrike certification
Security Information and Event Management platform
MITRE ATT&CK

Work Setting

Location is Rosslyn, VA (remote). Travel up to 20% on average may be required, along with potential client onsite or Deloitte office work up to 5 days per week.

Additional Skills

Ability to work independently and collaborate as part of a team
Effective written and verbal communication skills
Meticulous attention to detail and quality of work product
Ability to build and sustain professional relationships
Ability to lead projects or workstreams
Ability to manage and prioritize multiple tasks in a fast-paced, dynamic environment
Strong interpersonal skills and professional demeanor
Ability to meet deadlines
Ability to provide clear guidance to others

Preferred Qualifications

2+ years experience:
- Supporting enterprise monitoring in a Security Operations Center
- Onboarding and normalizing log sources in a Security Information and Event Management platform
- Mapping detections to MITRE ATT&CK techniques
- Cloud security monitoring in Amazon Web Services, Microsoft Azure, or Google Cloud Platform
- Hands-on experience with scripting or query languages used for detection and log analysis
Security certification such as CompTIA Security+ or GIAC certification

Compensation and Incentives

The salary range for this role is USD 102,500 - 188,900 per year. Deloitte may also offer eligibility to participate in a discretionary annual incentive program, subject to program rules and factors including individual and organizational performance.

Education

A Bachelor's degree in computer science, cybersecurity, information technology, engineering, or a related technical field is required.

View full job page →

3d ago

Cybersecurity Engineer II

Lyntris San Diego, CA

San Diego, CA

3d ago

$110k - $130k/yr Full time Cybersecurity Tools Engineer Ids/ips

Apply Now

Job Description

Lyntris is hiring a Cybersecurity Engineer II to support planning, execution, and communication of cybersecurity and National Security assessments, along with the engineering work needed to deliver network defense capabilities in complex DoD environments. This onsite role in San Diego, CA brings together assessment, integration, testing, and deployment responsibilities across enterprise and operational security tooling.

The ideal candidate will help design and field cybersecurity solutions, configure and troubleshoot SIEM and detection technologies, and perform network and security analysis using established tools and methodologies. Work will also include coordination with government, vendors, engineering teams, and international stakeholders to resolve technical issues and align on recommendations.

Role summary

In this position, you will plan, execute, and present National Security and Cybersecurity assessments and technical recommendations. You will also design, engineer, integrate, test, and deploy cybersecurity and network defense solutions across complex DoD environments, including activities supporting the acquisition, integration, testing, deployment, and sustainment lifecycle. Support may extend to Foreign Military Sales (FMS) programs and international customer engagements as required.

Responsibilities

Plan, execute, and present National Security and Cybersecurity assessments, analyses, studies, and technical recommendations.
Design, engineer, integrate, test, and deploy cybersecurity and network defense solutions across complex DoD environments.
Configure, integrate, and troubleshoot Splunk Enterprise, Splunk Enterprise Security, SIEM, IDS/IPS, firewalls, vulnerability management tools, and network monitoring solutions.
Support DoD Computer Network Defense (CND) requirements, boundary defense, vulnerability mitigation, remediation, and risk management activities.
Integrate cybersecurity solutions across Windows, Linux/Unix, network infrastructure, servers, security appliances, APIs, and third-party platforms.
Conduct network and security analysis using tools such as Wireshark, Tenable, Splunk, and network taps.
Use automation, scripting, APIs, generative AI, and agentic coding to improve cybersecurity engineering, analysis, testing, and troubleshooting.
Coordinate and support vendor integration, testing, demonstrations, and fielding activities, including CONUS and OCONUS events.
Collaborate with government, vendors, engineering teams, and international stakeholders to resolve technical issues and reach consensus.
Develop technical documentation, test procedures, assessment reports, briefings, and customer presentations.
Support cybersecurity activities across the acquisition, integration, testing, deployment, and sustainment lifecycle.
Support Foreign Military Sales (FMS) programs and international customer engagements as required.

Requirements

Currently holds an active U.S. national security clearance or be able to receive and maintain one.
5–7+ years of relevant hands-on cybersecurity, network defense, systems engineering, or National Security experience.
Bachelor's degree in Computer Engineering, Electrical Engineering, Computer Science, Cybersecurity, Network Engineering, or a related technical field.
Demonstrated experience with enterprise cybersecurity technologies and network defense architectures.
Hands-on experience with Splunk Enterprise and Splunk Enterprise Security.
Experience with enterprise IDS/IPS and firewall technologies.
Experience with vulnerability assessment and management tools such as Tenable Nessus/Tenable.sc.
Experience with Wireshark and network traffic analysis.
Experience integrating cybersecurity products across complex hardware/software environments.
Experience with APIs, scripting, automation, or software development.
Strong written, verbal, analytical, and presentation skills.
Ability to travel CONUS and OCONUS as required.

Technologies

Splunk Enterprise, Splunk Enterprise Security, SIEM
IDS/IPS, firewalls, network monitoring solutions
Wireshark, Tenable, network taps
Windows, Linux/Unix
APIs, generative AI, agentic coding
Palo Alto, Cisco Firepower, Trellix NX
Tenable Nessus, Tenable.sc
Python, PowerShell, Bash, REST APIs

Pay & benefits

The pay range for this role is USD 110,000 - 130,000 per year (San Diego, CA (HDG)).

Paid Time Off
Paid Company Holidays
Medical, Dental & Vision Insurance
Optional HSA and FSA
Base and Voluntary Life Insurance
Short Term & Long-Term Disability Insurance
401k Matching
Employee Assistance Program

Clearance requirements

Some positions will require access to U.S. National Security information.
Positions that require this access will be required to receive and maintain a U.S. government personnel security clearance (PCL).
To qualify for this position, the candidate must be a US Citizen and either currently possess this National Security eligibility or be able to complete the investigation application process with a favorable determination and maintain that eligibility throughout employment.

View full job page →

5d ago

Sr. Security Engineer - Cloud Threat Detection

The Hartford Hartford, CT

Hartford, CT

5d ago

$128k - $193k/yr Full time Ai Security Analytics Cloud Platforms

Apply Now

Job Description

The Hartford is looking for a Senior Security Engineer to build and improve enterprise-scale cloud threat detection across AWS and Google Cloud Platform (GCP). In this hybrid role, you will design high-fidelity detections, connect cloud security telemetry to the enterprise SIEM, and help the SOC reduce false positives while strengthening visibility into cloud-based threats.

What you’ll do

Design, develop, test, and deploy detection content for suspicious activity and threats across AWS and GCP.
Integrate and normalize cloud security telemetry from AWS and GCP into the enterprise SIEM platform.
Build detections using sources including AWS GuardDuty, AWS CloudTrail, AWS VPC Flow Logs, AWS Config, Google Security Command Center (SCC), Google Cloud Audit Logs, Google Cloud Logging, IAM telemetry, and other 3rd-party CSMPs (Orca, CrowdStrike, Wiz).
Create and maintain SIEM detections and related content such as analytics, risk-based detections, dashboards, assets, identities, and alerting logic.
Tune and optimize detection logic over time to improve detection fidelity and coverage while reducing false positives.
Map detections to MITRE ATT&CK and relevant cloud-specific attack techniques.
Participate in adversary emulation, purple team exercises, and cloud attack simulations to validate detection effectiveness.
Develop detection requirements and enrichment strategies that support AI/SOAR automation and incident response workflows.
Create and maintain SOPs, runbooks, and investigation guides for cloud-based detections and alerts.
Train and mentor L1 and L2 SOC analysts on cloud threat tactics and investigation workflows, including CloudTrail and GCP Audit Log analysis and triage steps using AWS and GCP consoles.
Provide advanced escalation support to SOC and Incident Response teams during cloud security investigations.
Join on-call support rotations (approximately 5 weeks annually).

Required qualifications

5+ years of cybersecurity experience with direct involvement in security operations, incident response, threat detection, or detection engineering.
Hands-on operational experience securing both AWS and GCP environments.
Strong knowledge of AWS security services and GCP security services.
Experience developing and tuning enterprise SIEM detections using cloud telemetry.
Experience integrating cloud-native security tools and log sources into enterprise security monitoring platforms such as Splunk Enterprise Security, Microsoft Sentinel, QRadar, Cortex XSIAM, and others.
Strong understanding of cloud attack methodologies including identity compromise, privilege escalation, persistence, lateral movement, and data exfiltration.
Experience investigating alerts using raw cloud telemetry, including CloudTrail and GCP Audit Logs.
Ability to create operational documentation, investigation guides, SOPs, and analyst playbooks.
Experience training and mentoring SOC analysts on cloud threat investigation and triage.
Strong written and verbal communication skills.

Location and schedule

Hartford, CT (hybrid)
Office expectation: 3 days a week (Tuesday to Thursday) in Columbus, OH, Chicago, IL, Hartford, CT, or Charlotte, NC.

Compensation

Base pay range: USD 128,400 - 192,600 per year.

Technologies you may work with

AWS, GCP, AWS GuardDuty, AWS CloudTrail, Splunk (RBA), Splunk Enterprise Security, Google Security Command Center (SCC), Google Cloud Logging, AWS VPC Flow Logs, AWS Config, Google Cloud Audit Logs, IAM, Microsoft Sentinel, QRadar, Cortex XSIAM, Orca, CrowdStrike, Wiz, MITRE ATT&CK, SOPs, AI/SOAR, Python, PowerShell, Bash.

Preferred qualifications

Demonstrated experience with Splunk Enterprise Security, SPL, data modeling, Risk-Based Alerting (RBA), and dashboard creation.
Strong understanding of adversary behavior, MITRE ATT&CK, cyber kill chain, and threat modeling.
Experience with SOAR platforms and security automation workflows.
Scripting and automation experience using Python, PowerShell, or Bash.
Experience supporting multi-cloud security programs.
Hands-on threat hunting in cloud environments.
Exposure to EDR platforms such as CrowdStrike, SentinelOne, or Microsoft Defender XDR for Endpoint.

Preferred certifications

AWS Certified Security – Specialty
Google Professional Cloud Security Engineer
GIAC Cloud Threat Detection (GCTD)
GIAC Certified Incident Handler (GCIH)
GIAC Cyber Threat Intelligence (GCTI)
Splunk Certified Architect or Consultant

Work authorization: Candidate must be authorized to work in the US without company sponsorship. The company will not support the STEM OPT I-983 Training Plan endorsement for this position.

View full job page →

18d ago

Cybersecurity Threat Hunter

Binary Defense Houston, TX 🇺🇸 Remote

Houston, TX

18d ago

Full time Crowdstrike Cyber Investigation Endpoint Security

Apply Now

Job Description

Binary Defense is hiring a Threat Hunter in Houston, TX (remote) to track attacker techniques and translate intelligence into actionable detection and client threat hunts.

Responsibilities

Monitor emerging threat actor techniques using breaking research, threat intelligence reporting, and firsthand observation, then evaluate relevance to client environments
Conduct original research from observed malware and threat actor TTPs, including extracting IOCs and identifying detection opportunities
Build and tune client-facing threat hunts as queries across customer EDR and SIEM platforms
Act as a technical point of contact for clients by communicating hunt findings, methodology, and recommendations to improve security posture
Perform static and dynamic malware analysis to understand malicious behavior, execution flow, and common evasion techniques
Review telemetry, logs, and alerts to identify suspicious behavior across Windows, Linux, and macOS
Collaborate with Threat Hunters and SOC analysts to support investigations and deliver technical findings
Stay current on the latest threat actor techniques and cybersecurity developments affecting client networks
Support and mentor less experienced team members as the role grows

Requirements

Hands-on threat hunting experience using EDR and/or SIEM platforms such as Microsoft Sentinel, Splunk, and CrowdStrike
Ability to build and tune hunting and detection queries using platform-native query languages (for example KQL and SPL)
Strong written and verbal communication to explain technical findings clearly to clients and teammates
Working knowledge of threat actor techniques, defense evasion, and the current threat landscape
Experience converting threat intelligence into deployable hunt and detection logic
Familiarity with malware analysis techniques and the ability to interpret and apply results
Network traffic analysis experience
Experience with Windows environments, with working familiarity across Linux and macOS
Strong research and technical analysis skills, with problem-solving, interpersonal, organizational strengths, and attention to detail
Associate’s degree in Computer Science, Information Security, Incident Response, Forensics, or a related field (or 2+ years hands-on experience)

Technologies

Microsoft Defender, Microsoft Sentinel, Splunk, CrowdStrike
EDR, SIEM
KQL, SPL
PowerShell, VBA, JavaScript, .NET, Python, Bash

Benefits

Competitive medical, dental, and vision coverage for employees and dependents
401k match which vests every payroll
Flexible and remote-friendly work environment
Training opportunities to expand your skill set

Preferred Qualifications

Bachelor’s or master’s degree in computer science or Cybersecurity (or 4+ years hands-on experience)
2+ years of experience in threat hunting, detection engineering, incident response, or a SOC role
Experience analyzing or de-obfuscating scripts (PowerShell, VBA, JavaScript, .NET, and similar)
Scripting or programming experience (for example Python, PowerShell, or Bash) to support analysis and internal tooling
Experience publishing original research through blog posts, public reporting, or conference talks
Malware reverse engineering experience (static and dynamic)
Digital forensics and incident response experience
Experience mentoring other analysts

View full job page →

20d ago

Sr. SecOps Security Engineer

Police and Fire Federal Credit Union Bensalem, PA

Bensalem, PA

20d ago

Full time Cybersecurity Tools Data Security Endpoint Security

Apply Now

Job Description

Police and Fire Federal Credit Union is hiring a Sr. SecOps Security Engineer reporting to the Manager SecOps for an onsite role in Bensalem, PA.

Responsibilities

Design, implement, and manage Splunk SIEM for centralized security monitoring, advanced threat detection, and incident response
Manage and monitor IDS/IPS systems and respond to suspicious activity
Deploy and maintain network-based DLP solutions and develop policies to support data privacy
Perform regular vulnerability assessments using tools such as Nessus and support remediation efforts
Deploy zero-day threat protection and develop response strategies
Manage endpoint protection technologies to help guard against malware
Implement identity and access management solutions including Okta and RSA
Architect and configure secure network solutions, including firewalls, NGFW, and Web Content Filtering
Maintain security architecture documentation and generate regular security posture reports
Collaborate with IT and compliance teams by providing guidance on security best practices
Work with IT and compliance teams to assess and reduce security risk and support regulatory compliance

Requirements

Bachelor’s degree in Computer Science, Information Technology, or a related field
5+ years of hands-on information security engineering and administration experience
Demonstrated technical knowledge of perimeter security devices and configuration
Proficiency in virtualized environments, including substantial experience with VMware and other virtualization technologies
Analytic ability and good judgment to assess problems and situations
Effective business communication and technical writing skills
In-depth knowledge of financial institution regulations, including NCUA, GLBA, and PCI DSS
In-depth working knowledge of network perimeter security technologies, including:
- Web Filter (ForcePoint)
- SIEM (Splunk)
- Intrusion Detection/Protection Systems
- Network-based DLP
- Vulnerability scanners (Nessus)
- Zero Day technologies (FireEye/Trellix)
- Email security technologies
- Cisco Secure Workload (CSW)
- Cisco Identity Services Engine (ISE)
- XDR solutions (Cisco AMP, Trellix, MS Defender)
- FireEye (NX and CMS)
- MFA (Okta and RSA)
- StealthWatch
Working knowledge of Security Risk Assessment Methodology, vulnerability analysis, and strong knowledge of SIEM technology (Splunk)
Monitor and maintain network security appliances to ensure system integrity from internal and external entities
Document current and future InfoSec systems configuration and changes following PFFCU change control guidelines
Tier 2 problem escalation contact including rotating afterhours support
Develop a working knowledge of the business side of PFFCU and interface effectively with other IT teams
Strong project skills, including completing multi-month projects while maintaining focus
Experience working with third-party service providers
Ability to handle multiple projects, prioritize tasks, and think logically while visualizing abstract concepts
Ability to communicate technical information clearly to stakeholders at all levels and with vendors
Ability to work varying hours, including evenings and weekends
Participation in an on-call rotation
Core hours: Monday-Friday, 8:00 AM – 4:00 PM

Technologies

Splunk
Firewalls, NGFW
Web Content Filtering, ForcePoint
Intrusion detection/protection systems
Data Loss Prevention, network-based DLP
Nessus
Zero-day threat protection, FireEye/Trellix
Endpoint protection technologies
Okta, RSA
Security Information and Event Management (SIEM)
Identity and access management (IAM) solutions
VMware, virtualization technologies
NetFlow Visibility
Zero Day platform
FireEye (NX and CMS)
StealthWatch
MFA (Okta and RSA)
Cisco Secure Workload (CSW)
Cisco Identity Services Engine (ISE)
XDR solutions (Cisco AMP, Trellix, MS Defender)

Benefits

Excellent medical, dental, vision benefits: 75% to 90% of premiums covered by PFFCU
401K: PFFCU contributes an automatic 6% after 1 year regardless of employee contribution

View full job page →

21d ago

Cybersecurity Engineer

Intellibee Richmond, VA

Richmond, VA

21d ago

Full time Cloud Platforms Cybersecurity Tools Endpoint Security

Apply Now

Job Description

The Cybersecurity Engineer will develop and implement advanced cyber defense capabilities while operating and enhancing a Splunk SIEM environment. This onsite role in Richmond, VA supports Splunk Enterprise Security for monitoring, detection, analysis, and response to security events, with emphasis on log analysis, threat hunting, incident response, and Splunk detection and compliance reporting.

Key Responsibilities

Continuously monitor network traffic, endpoint logs, and cloud security events to identify anomalous behavior and potential security incidents.
Create, maintain, and tune Splunk correlation searches, alerts, and dashboards to reduce false positives and strengthen detection coverage.
Investigate potential security incidents, follow forensic evidence, and coordinate with IT and network teams to remediate identified threats.
Develop and refine detection and response playbooks using threat intelligence and frameworks such as MITRE ATT&CK.
Partner with infrastructure teams to onboard new data sources, ensuring log integrity, parsing, and normalization within the SIEM platform.
Support audit readiness by collecting SIEM control evidence and producing compliance reports aligned with internal policies and standards.

Required Qualifications

8+ years of hands-on cybersecurity experience, specifically operating, building, and investigating threats within a SIEM or Splunk environment.
Excellent critical thinking, problem-solving, and communication skills, including the ability to manage multiple security tickets and operate calmly under pressure.
Proficiency writing SPL (Splunk Processing Language).
Strong understanding of networking, firewalls, EDR, and cloud platforms such as AWS, Azure, or GCP.
Knowledge of security frameworks (for example, MITRE ATT&CK) and security compliance standards such as NIST, HIPAA, or SOC 2.
Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related field.
Relevant certifications such as Splunk Core Certified User and Splunk Core Certified Advanced Power User are highly preferred.