SIEM Subject Matter Expert (Splunk)

Role overview Own the architecture and ongoing health of a large Splunk Enterprise Security deployment supporting security monitoring across many endpoints. You will improve how the SOC collects and analyzes security data, develops detections, and automates alert handling. The role also includes platform lifecycle management and helping analysts use the system effectively.

Responsibilities - Manage Splunk Enterprise Security architecture, sizing, performance, and overall platform health. - Create and tune correlation rules and detection use cases aligned with the MITRE ATT&CK framework. - Add log sources and normalize data across a varied endpoint environment. - Build and maintain SIEM-to-SOAR integrations for automated alert enrichment and response. - Report on performance and recommend capacity needs. - Support upgrades, patching, and platform lifecycle work; resolve performance and data-quality issues. - Train and mentor SOC analysts on Splunk practices.

Requirements - At least 5 years of SIEM architecture or engineering experience, including large deployments with substantial daily data volumes. - Bachelor’s degree in computer science, information technology, or a related field; equivalent experience may be considered. - Deep knowledge of Splunk architecture, Search Processing Language (SPL), and data onboarding. - Experience integrating SIEM systems with SOAR platforms for automated response. - Splunk Certified Architect certification, or Splunk Enterprise Security Certified Admin certification.