Senior Splunk Engineer - UEBA & DoD Security Analytics

Peraton; Tampa (FL); On-site; USD 120,000 - 150,000; Full time

Job summary

Peraton is seeking a Splunk Engineer to design, administer, and optimize the enterprise Splunk environment with a heavy focus on UEBA at MacDill AFB, Florida.

The role requires DoD TS/SCI clearance and DoD 8570 IAT II certification, with experience deploying UEBA, data normalization with CIM, and integrating analytics into ES and SOAR workflows. You will collaborate with SOC/Insider Threat teams to detect anomalous activity.

Qualifications

• DoD 8570 IAT II Certification.
• DoD TS/SCI clearance.
• Experience with UEBA using Splunk.
• Python or Bash automation for Splunk tasks and API integrations.
• Knowledge of MITRE ATT&CK framework.

Responsibilities

• Design, administer, and optimize the enterprise Splunk environment with a focus on UEBA.
• Lead design, engineering and deployment of Splunk UEBA from identity data sources.
• Develop ML models to establish baselines for user/entity behavior.
• Collaborate with Insider Threat and SOC teams to identify anomalies.
• Normalize data with Splunk CIM for UEBA analytics.
• Integrate UEBA anomalies into ES Incident Review dashboards and SOAR playbooks.
• Monitor UEBA health, ingestion rates, and platform stability.
• Document configurations and detection playbooks for teams.

Skills

DoD clearance

Splunk UEBA

Python scripting

Bash scripting

Education

High School Diploma

Associate/AA

Bachelor's (BS/BA)

Master's (MS/MA)

PhD

Tools

Splunk CIM

Splunk ES

SOAR

UEBA

Job description

Peraton is seeking a Splunk Engineer to design, administer, and optimize the enterprise Splunk environment with a heavy focus on UEBA at MacDill AFB, Florida.

The role requires DoD TS/SCI clearance and DoD 8570 IAT II certification, with experience deploying UEBA, data normalization with CIM, and integrating analytics into ES and SOAR workflows. You will collaborate with SOC/Insider Threat teams to detect anomalous activity.