Senior SOC Splunk Engineer: Threat Hunting & ES Architect

VaporVM; Dubai; On-site; AED 274,000 - 509,000; Full time

Job summary

The L3 SOC Splunk Engineer will serve as a senior technical resource responsible for advanced threat hunting, complex incident investigation, Splunk architecture and optimization, detection engineering and technical leadership within the SOC.

The engineer will handle the most complex security incidents escalated from L1 L2 and will contribute to improving the overall SOC detection and response capabilities.

Qualifications

• 7+ years of cybersecurity/SOC experience
• 4+ years of hands-on Splunk experience
• Significant experience with Splunk Enterprise Security
• Bachelor’s degree in Cybersecurity, CS, IS, IT, or related field
• Splunk ES certification highly preferred
• Splunk Core Certified Advanced Power User/Architect certifications advantageous
• GIAC, CISSP, GCIH, GCFA, or equivalent certifications are a strong advantage

Responsibilities

• Lead investigation of complex and high-severity security incidents
• Perform advanced threat hunting using Splunk and other security platforms
• Conduct advanced correlation and analysis of security events
• Develop advanced Splunk detection and correlation use cases
• Design and optimize Splunk Enterprise Security implementations
• Develop advanced SPL queries and complex correlation searches
• Lead detection engineering and use-case development
• Review and validate incident investigations

Skills

Splunk ES

SPL development

CIM data models

Correlation searches

Dashboards/reports

SIEM architecture

Threat hunting

MITRE ATT&CK

SOAR

Security automation

Investigations leadership

Education

Bachelor's degree in Cybersecurity/CS/IS/IT

Splunk ES certification

Core Certified Advanced Power User/Architect

GIAC/CISSP/GCIH/GCFA (or equivalent)

Tools

Splunk

Splunk Enterprise Security

SOAR tooling

Job description

The L3 SOC Splunk Engineer will serve as a senior technical resource responsible for advanced threat hunting, complex incident investigation, Splunk architecture and optimization, detection engineering and technical leadership within the SOC.

The engineer will handle the most complex security incidents escalated from L1 L2 and will contribute to improving the overall SOC detection and response capabilities.