Splunk SIEM Engineer - CSOC Detection & Automation

SoftServe; Poland; On-site; PLN 120,000 - 180,000; Full time

Job summary

SoftServe is seeking an Intermediate Engineer for its CSOC in Poland, focusing on strengthening monitoring and detection using Splunk and Splunk Enterprise Security. You will develop content, tune detections, and collaborate with IT, Security, and Delivery teams to advance threat visibility and incident response.

You will also onboard data sources, validate CIM compliance, and serve as L2 escalation for complex alerts and investigations, while building dashboards and automating workflows to

Qualifications

• 2+ years in security operations, SOC/CSOC, or related cybersecurity role.
• Hands-on with Splunk and Splunk Enterprise Security.
• Familiar with MITRE ATT&CK, NIST CSF, ISO 27001.
• Experience with Python or PowerShell and automation is a plus.

Responsibilities

• Develop, configure, and maintain Splunk content including dashboards and correlations.
• Own detection engineering and tune alerts to reduce false positives.
• Collaborate with Security, IT, and Delivery teams to improve monitoring and investigations.
• Onboard and validate security data sources and CIM compliance.
• Act as L2 escalation for complex alerts and incidents.
• Build dashboards and reporting to support monitoring and incident response.
• Support integrations between security platforms and enterprise services.
• Document technical processes and contribute to automation initiatives.

Skills

Splunk SPL

Detection engineering

Incident investigation

English communication

Python

PowerShell

Education

Bachelor's degree in IT/CS/Cybersecurity

Tools

Splunk

Splunk Enterprise Security

SOAR platforms

AI-enabled tools

Job description

SoftServe is seeking an Intermediate Engineer for its CSOC in Poland, focusing on strengthening monitoring and detection using Splunk and Splunk Enterprise Security. You will develop content, tune detections, and collaborate with IT, Security, and Delivery teams to advance threat visibility and incident response.

You will also onboard data sources, validate CIM compliance, and serve as L2 escalation for complex alerts and investigations, while building dashboards and automating workflows to