Splunk Enterprise Security Engineer

Orbus International; Hinoba-an; On-site; PHP 900,000 - 1,300,000; Full time

Job summary

Orbus International in the Philippines seeks a Splunk Platform Engineer to manage and optimize Splunk Enterprise Security, including data models, correlation searches, and content management. You will design detections aligned with MITRE ATT&CK and tune risk-based alerting to reduce false positives.

You will onboard and normalize security data sources, troubleshoot ingestion issues, and collaborate with SOC teams to improve detection coverage and drive continuous improvement of the Splunk

Qualifications

• Strong foundation in Splunk Platform Engineering.
• Capable of independently administering Splunk Enterprise Security.
• Experienced in building high-quality detections using MITRE ATT&CK.
• Practical understanding of Risk-Based Alerting (RBA) and detection tuning.
• Able to bridge platform operations with security detection engineering.

Responsibilities

• Manage and administer Splunk Enterprise Security (ES), including Data Models, Correlation Searches, Notable Events, Threat Intelligence Framework, Asset & Identity, and Content Management.
• Design, develop, and tune security detection use cases aligned with MITRE ATT&CK using SPL and Splunk ES correlation searches.
• Implement and optimize Risk-Based Alerting (RBA) to reduce false positives and improve alert fidelity.
• Onboard and normalize security data sources using CIM, troubleshoot data ingestion/parsing issues, and ensure data quality for security analytics.
• Collaborate with SOC & security teams to enhance detection coverage and support incident investigations.

Skills

Splunk ES

MITRE ATT&CK

Detection engineering

Risk-Based Alerting (RBA)

Platform operations

Tools

Splunk CIM

Data Models

Correlation Searches

Job description

JD:

• Manage and administer Splunk Enterprise Security (ES), including Data Models, Correlation Searches, Notable Events, Threat Intelligence Framework, Asset & Identity, and Content Management.


• Design, develop, and tune security detection use cases aligned with the MITRE ATT&CK framework using SPL and Splunk ES correlation searches.


• Implement and optimize Risk-Based Alerting (RBA), including risk rules, risk modifiers, and detection tuning to reduce false positives and improve alert fidelity.


• Onboard and normalize security data sources using CIM, troubleshoot data ingestion/parsing issues, and ensure data quality for security analytics.


• Collaborate with SOC & security teams to enhance detection coverage, validate use cases, and support incident investigations and continuous improvement of the Splunk security platform.

Ideal Candidate Profile

• Strong foundation in Splunk Platform Engineering.


• Capable of independently administering Splunk Enterprise Security.


• Experienced in building high-quality detections using MITRE ATT&CK.


• Practical understanding of Risk-Based Alerting (RBA) and detection tuning.


• Able to bridge platform operations with security detection engineering