Hybrid SIEM Engineer - Splunk & Incident Response Expert

Piper Companies; Raleigh (NC); Hybrid; USD 115,000 - 135,000; Full time

Job summary

Piper Companies is seeking an experienced SIEM Engineer to strengthen enterprise security monitoring for a leading technology organization. The role focuses on Splunk SPL development, centralized SIEM integration, and incident response support in a hybrid on-site setting based in Durham, NC or Fulton, MD.

You will build dashboards, optimize CIM normalization, manage knowledge objects, and collaborate with security and engineering teams to improve detection content and overall SIEM effectiveness.

Qualifications

• Minimum 5 years of experience in cybersecurity, security operations, or SIEM engineering.
• Active Secret security clearance is required.
• Hybrid work from Durham, NC, or Fulton, MD.
• Hands-on Splunk expertise with SPL query development and optimization.
• Strong knowledge of CIM normalization and data models.

Responsibilities

• Build, enhance, and maintain Splunk SPL queries for security analytics and threat detection.
• Integrate tools and data sources into a centralized SIEM environment.
• Create and optimize dashboards, alerts, reports, and saved searches.
• Configure field extractions and CIM-compliant data normalization.
• Assist in incident response investigations and provide actionable recommendations.
• Collaborate with security and engineering teams to improve detection content.
• Document SIEM configurations, processes, and best practices.

Skills

Splunk SPL

Incident response

Security operations

Data normalization

Security monitoring

Tools

Splunk

EDR

IDS/IPS

Firewalls

Cloud security

Job description

Piper Companies is seeking an experienced SIEM Engineer to strengthen enterprise security monitoring for a leading technology organization. The role focuses on Splunk SPL development, centralized SIEM integration, and incident response support in a hybrid on-site setting based in Durham, NC or Fulton, MD.

You will build dashboards, optimize CIM normalization, manage knowledge objects, and collaborate with security and engineering teams to improve detection content and overall SIEM effectiveness.