Cybersecurity Splunk SOAR Engineer at GDIT Florida

GDIT; Venice (FL); On-site; USD 140,000 - 180,000; Full time

Job summary

Itlearn360 is seeking a Cybersecurity Splunk SOAR Engineer to design and implement a distributed SOAR platform at MacDill AFB. The role requires TS/SCI clearance and US citizenship, with a focus on automation, playbooks, and integrations across security tools.

Responsibilities include developing complex Python-based playbooks, ensuring high availability, and collaborating with SOC teams to reduce MTTR while improving security operations effectiveness.

Qualifications

• DoD 8140/8570 certifications are required.
• 8+ years of related experience in IT/security.
• Deep hands-on Splunk SOAR administration in distributed enterprise.
• Advanced Python scripting for creating playbooks and integrations.
• Experience integrating SOAR with Splunk ES and core tools.
• Strong security operations knowledge and incident response lifecycles.
• Experience with RESTful APIs and connectors for interoperability.
• Strong communication skills for technical and non-technical audiences.
• US citizenship and TS/SCI clearance are required.

Responsibilities

• Design, deploy, and document Splunk SOAR architecture for availability and scalability.
• Develop and customize complex SOAR playbooks for enrichment, triage, containment, and remediation.
• Integrate SOAR with diverse security tools via API and custom apps.
• Manage data flow between Splunk ES and SOAR to trigger automation actions.
• Create custom apps/integrations for tools not covered by standard connectors.
• Collaborate with SOC analysts and incident response teams to automate workflows.
• Track metrics for SOAR utilization and MTTR reduction.
• Maintain detailed documentation of SOAR content and configurations.

Skills

Splunk SOAR administration

Python scripting

SOAR integrations

Security operations concepts

RESTful APIs

CIM data parsing

Clear communication

US citizenship

TS/SCI clearance

Education

DoD 8140/8570 certifications

Tools

Splunk Enterprise Security

Splunk Phantom / SOAR

EDR / TIP / SIEM

Git

Docker/Kubernetes

Job description

Cybersecurity Splunk SOAR Engineer

Location: USA, FL MacDill AFB

Full Time

Job Req: RQ211186

Regular Requisition

Clearance Level Must Currently Possess: Top Secret/SCI

Clearance Level Must Be Able to Obtain: Top Secret/SCI

Public Trust/Other Required: None

Job Family: IT Infrastructure and Operations

US Citizenship Required: Yes

Scheduled Weekly Hours: 40

Travel Required: Less than 10%

Telecommuting Options: Onsite

Work Location: USA FL MacDill AFB

Responsibilities

• Design, deploy, and document the distributed Splunk SOAR platform architecture, ensuring high availability, performance, and scalability across the security domain.
• Develop and customize complex SOAR playbooks (Python or Phantom Playbook Editor) for automated enrichment, triage, containment, and remediation of security incidents such as phishing, malware, and unauthorized access.
• Integrate Splunk SOAR with a diverse ecosystem of security tools, including Splunk Enterprise Security (ES), firewalls, EDR/XDR, vulnerability scanners, threat intelligence platforms, and ticketing systems via API and custom app development.
• Manage and optimize data flow between Splunk ES and Splunk SOAR, ensuring security events and alerts trigger appropriate and effective automation actions.
• Create custom apps and integrations for Splunk SOAR to connect with proprietary or unique security tools not supported by out‑of‑the‑box integrations.
• Collaborate with SOC analysts, threat hunters, and incident response teams to gather requirements, document workflows, and translate manual security procedures into robust, automated playbooks.
• Establish and track metrics for SOAR utilization, automation coverage, and Mean Time to Respond (MTTR) reduction to demonstrate platform value and drive continuous improvement.
• Develop and maintain detailed documentation of all SOAR content, platform configurations, and integration architectures.

Required Skills & Experience

• Certifications: Applicable DoD 8140 or DoD 8570
• Experience: 8+ years related experience
• Required Skills:
  • Deep, hands‑on expertise with Splunk SOAR (Phantom) administration, configuration, and maintenance in a distributed, enterprise environment.
  • Advanced proficiency in Python scripting for developing and customizing SOAR playbooks, custom apps, and integrations.
  • Proven experience integrating SOAR with Splunk Enterprise Security (ES) and core security tools (EDR, TIP, SIEM).
  • Strong understanding of security operations principles, incident response lifecycles, and threat detection methodologies.
  • Experience with RESTful APIs and developing connectors for tool interoperability.
  • Proficiency in data manipulation, security log parsing, and understanding of the Common Information Model (CIM) in a security context.
  • Strong verbal and written communication skills with the ability to articulate complex security automation concepts to technical and non‑technical audiences.
• Desired Skills:
  • Familiarity with cloud security logging, containerization (Docker/Kubernetes), and CI/CD pipelines for playbook deployment.
  • Knowledge of MITRE ATT&CK framework and its application in developing automated detection and response use cases.
  • Experience with Git or other version control systems for managing SOAR content.
  • Familiarity with network protocols, operating systems (Windows/Linux), and enterprise architecture components relevant to security monitoring.
  • Splunk Enterprise Security Certified Admin or Architect Certification.
  • Splunk Phantom / SOAR Certified Content Developer or Administrator Certification.
  • Experience with other SOAR platforms (Palo Alto Cortex XSOAR, IBM Resilient).
  • Experience in a USCENTCOM, DoD, or multi‑domain security operations environment.
  • ITIL 4 Foundation Certification.
• Security clearance level: TS/SCI clearance required.
• US citizenship required.
• Additional Responsibilities:
  • Support system upgrades, patching, and performance tuning across the Splunk SOAR infrastructure.
  • Provide advanced troubleshooting and support for SOAR platform issues and playbook execution errors.
  • Conduct training and mentorship for SOC staff on SOAR tool usage, basic content development, and best practices.
  • Evaluate and integrate emerging security technologies and threat intelligence feeds into the automation fabric.
  • Adhere to security best practices and compliance standards relevant to the operating environment.

Equal Opportunity Employment

Equal Opportunity Employer / Individuals with Disabilities / Protected Veterans.