Senior SIEM/Splunk Engineer - Enterprise Security & SOAR

Zachary Piper Solutions; Newington (VA); On-site; USD 165,000 - 210,000; Full time

Benefits offered by this job

Comprehensive benefits

Flexible schedule

Unlimited growth opportunities

Job summary

Zachary Piper Solutions is seeking a Senior SIEM/Splunk Engineer for a Federal Program in Newington, VA. This on-site role requires expertise designing, deploying, and tuning Splunk Enterprise and Splunk ES to support enterprise security monitoring, threat detection, and incident response.

The ideal candidate has 5–10+ years with Splunk, solid scripting skills (Python, Bash, PowerShell), and experience with security automation (SOAR) and cloud integrations. Active TS/SCI clearance is required.

Qualifications

• Bachelor’s degree in Cybersecurity, CS, IT, or related field (or equivalent experience)
• 5–10+ years hands-on experience with Splunk Enterprise and Splunk ES
• Experience designing, deploying, and supporting enterprise-scale Splunk environments with clustering, high availability, and large-volume data ingestion
• Strong expertise in Splunk architecture, SPL development, dashboards, data models, CIM mapping, and search optimization
• Experience with Splunk SOAR (Phantom), security automation, and orchestration workflows
• Knowledge of SIEM operations, SOC processes, threat detection, incident response, and MITRE ATT&CK
• Experience integrating security technologies including EDR/XDR, IDS/IPS, firewalls, cloud platforms (AWS/Azure/GCP), IAM, and threat intelligence feeds
• Proficiency with Linux/Unix administration, networking fundamentals, scripting (Python, Bash, PowerShell), and automation tools such as Git and Ansible
• Experience with security hardening, RBAC, SAML, TLS/SSL certificates, and enterprise security compliance requirements
• Splunk certifications (Architect, Enterprise Admin, ES Admin, SOAR, or equivalent) strongly preferred
• Active TS/SCI Security Clearance

Responsibilities

• Architect, deploy, administer, and optimize Splunk Enterprise, Splunk Enterprise Security (ES), and Splunk SOAR environments.
• Design and maintain scalable, highly available Splunk infrastructures, including clustering, distributed search, and large-scale data ingestion.
• Configure and manage data onboarding, parsing, normalization, CIM compliance, and integrations across security, infrastructure, cloud, and application data sources.
• Develop and tune correlation searches, risk-based alerting (RBA), dashboards, data models, and MITRE ATT&CK-aligned detection content.
• Implement and maintain SOAR playbooks, automated response workflows, and integrations with security tools, cloud platforms, and ticketing systems.
• Perform health checks, performance tuning, capacity planning, upgrades, migrations, and platform modernization initiatives.
• Establish and maintain Splunk governance, RBAC, security hardening, compliance requirements, and operational standards.
• Automate deployments, configuration management, and administrative tasks using Ansible, Git, Python, Bash, and PowerShell.
• Collaborate with SOC and Incident Response teams to improve detection capabilities, investigation workflows, and overall security operations.
• Maintain architecture documentation, operational procedures, playbooks, and technical standards.

Skills

SPL development

Splunk architecture

Security operations

Incident response

Automation scripting

Linux/Unix administration

Cloud integrations

RBAC & security hardening

Threat detection

SIEM concepts

Education

Bachelor’s degree in Cybersecurity/Computer Science/IT

Tools

Splunk Enterprise

Splunk Enterprise Security

Splunk SOAR/Phantom

Ansible

Git

Python

Bash

PowerShell

Linux

Job description

Zachary Piper Solutions is seeking a Senior SIEM/Splunk Engineer for a Federal Program in Newington, VA. This on-site role requires expertise designing, deploying, and tuning Splunk Enterprise and Splunk ES to support enterprise security monitoring, threat detection, and incident response.

The ideal candidate has 5–10+ years with Splunk, solid scripting skills (Python, Bash, PowerShell), and experience with security automation (SOAR) and cloud integrations. Active TS/SCI clearance is required.