Senior Splunk Cyber Threat Detection Engineer (ML)

CRI Advantage, Inc.; Idaho Falls (ID); On-site; USD 110,000 - 170,000; Full time

Job summary

CRI Advantage, Inc. seeks a security data engineer to design, build, and tune detections across our environment using Splunk SPL and ES. You will operationalize ML models with the DSDL and AITK to improve anomaly detection and threat identification.

You will map coverage to the MITRE ATT&CK framework, collaborate with threat intel and SOC teams, reduce false positives, and maintain detection-as-code workflows with version control and CI/CD. Relocation to Idaho Falls is required.

Qualifications

• Deep expertise in Splunk SPL with advanced search, statistics, data models, and performance optimization.
• Hands-on experience with Splunk Enterprise Security (ES), including correlation searches and risk-based alerting.
• Experience with Splunk App for Data Science and Deep Learning (DSDL).
• Experience with Splunk AI Toolkit (AITK) for ML-based detections.
• Strong understanding of MITRE ATT&CK framework and detection engineering methodology.
• Familiarity with security data (EDR, network, cloud, identity).

Responsibilities

• Design, develop, and maintain detection content using Splunk SPL to identify threats across diverse data sources.
• Build and tune correlation searches, notable events, and risk-based alerting within Splunk Enterprise Security (ES).
• Leverage the Splunk App for Data Science and Deep Learning (DSDL) to operationalize machine learning models for anomaly detection and advanced threat identification.
• Apply the Splunk App for Anomaly Detection and the Splunk AI Toolkit (AITK) to develop ML-driven detections that go beyond signature-based approaches.
• Map detection coverage to the MITRE ATT&CK framework and identify gaps in visibility.
• Collaborate with threat intelligence, incident response, and SOC teams to translate emerging threats into actionable detections.
• Reduce false positives and alert fatigue through continuous tuning and detection lifecycle management.
• Develop and maintain detection-as-code workflows, including version control, testing, and CI/CD for detection content.
• Create documentation, runbooks, and detection specifications to support downstream analysts.

Skills

Splunk SPL

Splunk ES

AITK (Splunk AI Toolkit)

DSDL

MITRE ATT&CK

Detection engineering

Python

Tools

DSDL

Splunk App for Data Science and Deep Learning

Git

CI/CD pipelines

Splunk AI Toolkit

Job description

CRI Advantage, Inc. seeks a security data engineer to design, build, and tune detections across our environment using Splunk SPL and ES. You will operationalize ML models with the DSDL and AITK to improve anomaly detection and threat identification.

You will map coverage to the MITRE ATT&CK framework, collaborate with threat intel and SOC teams, reduce false positives, and maintain detection-as-code workflows with version control and CI/CD. Relocation to Idaho Falls is required.