Senior Splunk Engineer

System Soft Technologies; Arlington (VA); On-site; USD 130,000 - 170,000; Full time

Job summary

System Soft Technologies seeks a seasoned Splunk engineer to lead dashboards, alerts, and data ingestion for security observability. You will collaborate with network teams to integrate flow data and build high-fidelity detections across log and traffic sources.

You will tune ingestion pipelines, maintain CIM data models, and mentor junior engineers in SPL and detection development while supporting secure enclave deployments. Strong collaboration across cyber teams is required.

Qualifications

• Bachelor's degree in a related field OR
• Associates degree with an additional 2+ years of relevant IT experience OR
• High school diploma or GED equivalent with an additional 4+ years of directly related IT experience in lieu of degree
• 12+ years of cybersecurity or network engineering experience with 3+ years of Splunk engineering and content development
• Hands-on experience with Splunk Enterprise and Enterprise Security (ES) in air-gapped or mission-secure environments
• Must hold a current DoD 8140 (or 8570) baseline certification at the IAT Level II or higher (e.g., CompTIA Security+)
• U.S. Citizen with active TS/SCI clearance.

Responsibilities

• Lead design and optimization of Splunk dashboards, alerts, and data ingestion.
• Collaborate with network and Extra Hop teams to integrate flow data into detections.
• Develop network visualizations and identify deviations using correlated log and traffic data.
• Tune log sources and ingestion pipelines to improve performance and reduce false positives.
• Maintain Splunk apps, indexes, forwarders, and CIM data models.
• Produce runbooks and training for SOC teams and stakeholders.
• Mentor junior engineers and analysts in SPL, dashboarding, and detection development.
• Work in air-gapped or mission-secure environments; support secure enclave deployments of Splunk.
• Other duties as assigned.

Skills

SPL development

Network traffic analysis

Multi-source log correlation

Data normalization with CIM/ES

Regex & dashboards

Documentation & mentoring

Cross-team collaboration

Education

Bachelor's degree in a related field

Associate's degree +2 years IT experience

High school diploma +4 years IT experience

Tools

Splunk Enterprise

Splunk Enterprise Security (ES)

Splunk CIM data models

Extra Hop

SolarWinds

Job description

Lead the design and optimization of Splunk dashboards, alerts, correlation searches, and data ingestion for security and network observability

Collaborate with network and Extra Hop teams to integrate flow data, traffic patterns, and anomalies into actionable Splunk detections

Support development of network baseline visualizations and identify deviations using correlated log and traffic data

Tune log sources and ingestion pipelines to improve performance, reduce false positives, and enhance signal fidelity

Develop and manage Splunk content related to firewalls, VPNs, proxies, routers, switches, and endpoint devices

Work with analysts to interpret detection triggers in context of network flows, packet captures, and behavior anomalies

Configure and maintain Splunk components including apps, indexes, forwarders, and CIM data models

Produce documentation, runbooks, and training for SOC teams and technical stakeholders

Operate in both connected and disconnected environments; support secure enclave deployments of Splunk

Mentor junior engineers and analysts in SPL, dashboarding, and detection development

Other duties as assigned

Qualifications

• Bachelor's degree in a related field OR
• Associates degree with an additional 2+ years of relevant IT experience OR
• High school diploma or GED equivalent with an additional 4+ years of directly related IT experience in lieu of degree
• 12+ years of cybersecurity or network engineering experience with 3+ years of Splunk engineering and content development
• Hands-on experience with Splunk Enterprise and Enterprise Security (ES) in air-gapped or mission-secure environments
• Must hold a current DoD 8140 (or 8570) baseline certification at the IAT Level II or higher (e.g., CompTIA Security+)
• U.S. Citizen with active TS/SCI clearance.

Knowledge, Skills and Abilities:

• Expert-level Splunk SPL development and content creation
• Strong understanding of TCP/IP, packet structures, and network traffic analysis
• Familiarity with Extra Hop, SolarWinds, and PCAP-based threat identification
• Ability to correlate multi-source logs with behavioral and network data to create high-fidelity detections
• Experience tuning and normalizing data to align with Splunk CIM and ES frameworks
• Proficiency with regex, lookup tables, macros, and dashboard visualizations
• Excellent documentation and mentoring skills
• Comfortable working across cyber, networking, and threat teams to improve detection and visibility