Hybrid Splunk Cybersecurity Architect

Cognizant; Vancouver; Hybrid; CAD 78,000 - 124,000; Full time

Benefits offered by this job

Medical/Dental/Vision/Life Insurance

Paid holidays plus Paid Time Off

Long-term/Short-term Disability

Paid Parental Leave

Job summary

Cognizant in Vancouver, BC is seeking a Splunk Cybersecurity Architect to design and enhance enterprise security monitoring, detection, automation, and response capabilities.

You will lead across Splunk SIEM, SOAR, Microsoft Defender, and Cisco security tools, shaping detection strategies aligned with MITRE ATT&CK, ISO 27001, and PCI-DSS.

This hybrid role requires 3 days per week at a Cognizant office in Vancouver, with travel as needed and a focus on improving cyber resilience.

Qualifications

• Splunk advanced SPL and CIM/data model architecture, dashboards, data onboarding, and performance tuning.
• SOAR playbooks design/authorship, enrichment and API integrations.
• Microsoft Defender EDR telemetry analysis and threat management.
• Cisco Umbrella DNS/T tunnels detection and Cisco Secure Email for phishing/BEC.
• Knowledge of MITRE ATT&CK mapping for detection coverage and gap analysis.
• ISO 27001 ISMS controls and PCI-DSS requirements applied.

Responsibilities

• Design and architect enterprise SIEM solutions using Splunk, including CIM architecture, data onboarding strategies, correlation searches, risk-based alerting, and dashboards.
• Develop and maintain advanced SPL queries, detection use cases, and threat analytics for visibility and detection effectiveness.
• Architect and develop automated response and orchestration workflows using Splunk SOAR (Phantom), XSOAR, or similar.
• Lead development and tuning of detection content leveraging Defender, Cisco Umbrella, and Secure Email solutions.
• Establish architecture standards, best practices, and governance for cybersecurity platforms and monitoring technologies.

Skills

Splunk SIEM

SPL queries

Threat detection

Python/PowerShell

MITRE ATT&CK

ISO 27001/PCI-DSS

SOAR orchestration

Cisco security

Tools

Splunk Phantom

XSOAR

Python tooling

PowerShell tooling

Microsoft Defender EDR

Cisco security tools

Job description

Cognizant in Vancouver, BC is seeking a Splunk Cybersecurity Architect to design and enhance enterprise security monitoring, detection, automation, and response capabilities.

You will lead across Splunk SIEM, SOAR, Microsoft Defender, and Cisco security tools, shaping detection strategies aligned with MITRE ATT&CK, ISO 27001, and PCI-DSS.

This hybrid role requires 3 days per week at a Cognizant office in Vancouver, with travel as needed and a focus on improving cyber resilience.