Cybersecurity Engineer (Splunk)

SEMAIS; Columbus (OH); On-site; USD 120,000 - 165,000; Full time

Job summary

SEMAIS in the United States is seeking a skilled Splunk Engineer to sustain the log collection and SIEM tier for a DoD logistics enterprise. You will manage on-premises collection, Cribl, and Splunk components, building dashboards and content to elevate threats to incident responders.

Responsibilities include maintaining Splunk ES, scripting in Python, and developing custom connectors to enable telemetry from diverse systems, in a mission-focused environment with DoD secrecy requirements.

Qualifications

• Seven years of relevant information technology experience.
• Experience with Splunk Core and Splunk Enterprise Security.
• Ability to build custom dashboards and reports from threat data.
• Develop integrations using Python and REST/SOAP.

Responsibilities

• Research, plan, install, configure, troubleshoot, maintain, and back up every component of the enterprise log management architecture.
• Own on-premises collection tier feeding an enterprise Splunk Cloud environment, including Cribl and Splunk Forwarders; manage patches and access controls.
• Build and maintain pipelines that ingest and route logs, optimizing ingest costs.
• Create customized dashboards in Splunk ES; develop rules, reports, and data monitors for threat identification.
• Develop operational dashboards and monitors for pipeline and SIEM health; monitor events per second and license usage.
• Collaborate with DLA CERT to route, mask, and parse threat data for hunting.
• Develop custom connectors with Python and REST/SOAP to enable telemetry from non-standard apps.

Skills

Splunk ES dashboards

Threat analysis

Python scripting

REST integration

SSH/Unix/Linux admin

Tools

Splunk

Cribl

Splunk Cloud

Python

REST API

SOAP API

Job description

Who We Are

Secured Managed Instructional Systems, LLC (SEMAIS) is a Service-Disabled Veteran-Owned Small Business (SDVOSB) that protects mission systems critical to federal agencies. Our leadership brings more than 30 years of combined government experience in cybersecurity, digital modernization, and workforce readiness. Today we focus on exposure management and are developing the next stage of AI governance. We run every engagement with military discipline: we assess the security architecture, detect threats and exposures, and protect mission systems with aligned controls. At SEMAIS, you will join a small team where each person shapes the outcome and builds a career grounded in purpose. Veterans, military spouses, and civilians committed to service will find a strong fit on our team.

Status

Contingent upon contract award. These positions support a DLA cybersecurity requirement at DLA Weapons Support and depend on award of the task order to SEMAIS or a teaming prime contractor. We will keep every candidate informed of the award timeline.

Employment

W2, full-time and hourly with no benefits package

Location: On-site at DLA Weapons Support in Columbus, Ohio, or Richmond, Virginia. Alternate worksite only where the Government approves one.

Travel: Up to six round trips per year, roughly four days each to Washington DC, Columbus, OH, and Richmond, VA.

The Role

You will engineer and sustain the log collection and SIEM tier for a DoD logistics enterprise. The work spans the on -premises collection pipeline through Splunk Enterprise Security itself: analyzing threat information from logs, intrusion detection systems, intelligence reports, and vendor sources, then building the dashboards and correlation content that elevate high-threat items to incident responders. Administration of Splunk ES and the backend infrastructure behind it, including upgrades and daily maintenance, is central to the job.

Job duties

• Research, plan, install, configure, troubleshoot, maintain, and back up every component of the enterprise log management architecture.


• Own the on-premises collection tier feeding an enterprise Splunk Cloud environment, covering Cribl Stream worker and leader nodes, Splunk Heavy Forwarders and Universal Forwarders, including patching, upgrades, performance tuning, and role-based access control.


• Build and maintain pipelines that ingest, normalize, parse, and route logs from across the enterprise, filtering low-value data at the pipeline layer to control ingest licensing cost.


• Create customized dashboards in Splunk Enterprise Security that elevate high-threat items to incident responders, and develop ES rules, reports, data monitors, active channels, trends, and use cases that identify threats and optimize data mining across DLA.


• Develop operational dashboards and monitors for pipeline and SIEM ingest health, giving real-time visibility into events per second by log source, Splunk Cloud license utilization, Cribl throughput, and dropped data.


• Work alongside the DLA CERT, who hold primary responsibility for threat detection content, providing specialized routing, masking, and complex parsing for their threat hunting.


• Analyze threat information drawn from logs, intrusion detection systems, intelligence reports and vendor sources, and make recommendations in line with the roles of CERT Incident Handlers and site Information Assurance Managers.


• Develop custom connectors with Python and REST or SOAP integration, so proprietary and non-standard applications without native integrations still deliver usable telemetry.

Clearance

Active DoD Secret. The position is designated IT I Critical Sensitive, which requires a Tier 5 investigation, formerly SSBI, adjudicated and current at the time of proposal submission. A Top Secret clearance satisfies this and is welcome, but Secret with a current Tier 5 is sufficient.

Experience

Seven years of relevant information technology experience, including integration and sustainment of Splunk Core and Splunk Enterprise Security, and building custom dashboards and reports from threat data.

Computing Environment

Linux+ and Splunk Administrator

DCWF 521 Primary

Cyber Defense Infrastructure Support, Intermediate proficiency. Any of: Security+, CySA+, CEH, SSCP, GSEC, GMON, Cloud+, or PenTest+.

DCWF 451 Primary

System Administrator, Intermediate proficiency. Any of: Security+, Cloud+, GSEC, GICSP, or SSCP. Certifications must align to the assigned work role under DoDM 8140.03.

SEMAIS is an equal opportunity employer. All qualified applicants receive consideration without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.