Splunk Enterprise Security Engineer | Detection & RBA

Orbus International; Hinoba-an; On-site; PHP 900,000 - 1,300,000; Full time

Job summary

Orbus International in the Philippines seeks a Splunk Platform Engineer to manage and optimize Splunk Enterprise Security, including data models, correlation searches, and content management. You will design detections aligned with MITRE ATT&CK and tune risk-based alerting to reduce false positives.

You will onboard and normalize security data sources, troubleshoot ingestion issues, and collaborate with SOC teams to improve detection coverage and drive continuous improvement of the Splunk

Qualifications

• Strong foundation in Splunk Platform Engineering.
• Capable of independently administering Splunk Enterprise Security.
• Experienced in building high-quality detections using MITRE ATT&CK.
• Practical understanding of Risk-Based Alerting (RBA) and detection tuning.
• Able to bridge platform operations with security detection engineering.

Responsibilities

• Manage and administer Splunk Enterprise Security (ES), including Data Models, Correlation Searches, Notable Events, Threat Intelligence Framework, Asset & Identity, and Content Management.
• Design, develop, and tune security detection use cases aligned with MITRE ATT&CK using SPL and Splunk ES correlation searches.
• Implement and optimize Risk-Based Alerting (RBA) to reduce false positives and improve alert fidelity.
• Onboard and normalize security data sources using CIM, troubleshoot data ingestion/parsing issues, and ensure data quality for security analytics.
• Collaborate with SOC & security teams to enhance detection coverage and support incident investigations.

Skills

Splunk ES

MITRE ATT&CK

Detection engineering

Risk-Based Alerting (RBA)

Platform operations

Tools

Splunk CIM

Data Models

Correlation Searches

Job description

Orbus International in the Philippines seeks a Splunk Platform Engineer to manage and optimize Splunk Enterprise Security, including data models, correlation searches, and content management. You will design detections aligned with MITRE ATT&CK and tune risk-based alerting to reduce false positives.

You will onboard and normalize security data sources, troubleshoot ingestion issues, and collaborate with SOC teams to improve detection coverage and drive continuous improvement of the Splunk