Remote Splunk Threat Detection Engineer

Openkyber; Alaska; On-site; USD 130,000 - 180,000; Full time

Job summary

Openkyber is seeking a highly skilled security data scientist to design and tune Splunk-based detections across diverse data sources. You will build correlation searches, notable events, and risk-based alerts within Splunk Enterprise Security, while applying ML techniques via the DSDL and AI Toolkit to detect anomalies and threats.

The ideal candidate holds current security clearance and has hands-on SOC, threat hunting, and incident response experience, with a strong focus on reducing false

Qualifications

• Requires current security clearance (L/UQ/Top Secret)
• Deep Splunk SPL expertise with advanced searches and data models
• Hands-on ES experience with correlation searches, risk-based alerting, notable events
• Experience with Splunk AI Toolkit for ML-based detections
• Experience with Splunk DSDL for model development and deployment
• Strong MITRE ATT&CK mapping and detection coverage awareness
• Familiarity with attack techniques, security data sources (EDR, cloud, identity)
• Nice-to-have: SOAR platforms, detection automation, and related certifications

Responsibilities

• Design, build, and tune detections using Splunk SPL across diverse data sources
• Develop and optimize correlation searches, notable events, and risk-based alerts in ES
• Leverage DSDL and AI Toolkit to create ML-based anomaly detections
• Develop detections via the DSDL/DSDL app for model deployment
• Map detection coverage to MITRE ATT&CK and identify visibility gaps
• Collaborate with threat intel, IR, and SOC to translate threats into detections
• Reduce false positives and alert fatigue through lifecycle management
• Maintain detection-as-code workflows with versioning, testing, and CI/CD
• Create documentation, runbooks, and specs for downstream analysts

Skills

Splunk SPL

Splunk ES

MITRE ATT&CK

Threat hunting

Anomaly detection

Detection engineering

Security analytics

Data modeling

Education

Splunk certification(s)

SIEM experience

GIAc/SOC applicable certs

Tools

DSDL

AITK

Splunk Enterprise Security

Git

CI/CD

Job description

Openkyber is seeking a highly skilled security data scientist to design and tune Splunk-based detections across diverse data sources. You will build correlation searches, notable events, and risk-based alerts within Splunk Enterprise Security, while applying ML techniques via the DSDL and AI Toolkit to detect anomalies and threats.

The ideal candidate holds current security clearance and has hands-on SOC, threat hunting, and incident response experience, with a strong focus on reducing false