Senior Splunk SIEM Architect & Detection Lead

Quantum Sky; Washington (District of Columbia); On-site; USD 145,000 - 155,000; Full time

Job summary

Quantum Sky is seeking a Senior SIEM Engineer to own and evolve the Splunk deployment—architecture, data onboarding, CIM normalization, and platform health. You will drive detection engineering within Splunk ES and mentor mid-level engineers, aligning Splunk capabilities with leadership's security strategy.

The role requires on-site work in Washington, DC, with five days/week in the environment, core hours 8am–4pm, and a Top Secret clearance with SCI eligibility.

Qualifications

• Bachelor's degree required; experience and education equivalents considered.
• 8 years of general work experience with 6 years in security operations or detection engineering, with Splunk ownership.
• Advanced proficiency in SPL, including complex correlation searches and data models.
• Deep Splunk architecture knowledge (indexer/search head clustering, forwarders), and Splunk ES if deployed.
• Strong understanding of MITRE ATT&CK, cyber kill chain, threat modeling.
• Experience designing detection strategies within Splunk, not just individual searches.
• Strong scripting/automation (Python, PowerShell) and SOAR integration familiarity.
• Experience with cloud security monitoring (AWS/Azure/GCP) and cloud add-ons.
• Incident response leadership experience.
• Familiarity with industry compliance frameworks; relevant Splunk certifications preferred.

Responsibilities

• Design and own the Splunk architecture, including clustering, forwarders, and storage strategy.
• Lead detection engineering strategy within Splunk ES based on threat intel and risk assessments.
• Establish standards for data onboarding, CIM normalization, and field extraction quality.
• Drive Splunk upgrades, app/add-on management, and integrations with security tools.
• Optimize search performance and licensing costs at scale.
• Mentor mid-level SIEM engineers and SOC analysts in SPL and use case design.
• Serve as escalation point for complex investigations and incidents.
• Evaluate new Splunk apps and architectural changes.
• Own Splunk metrics and reporting for leadership (detection coverage, MTTD, performance).
• Lead threat hunting using SPL, data models, and Splunk pivot/statistical functions.
• Ensure configurations meet PCI-DSS, HIPAA, SOC 2, NIST compliance.
• Represent SIEM in security architecture and incident response planning.

Skills

Splunk architecture

Detection engineering

SPL mastery

Python scripting

Cloud log monitoring

Threat modeling

Education

Bachelor's Degree

Tools

Splunk ES

SOAR platforms

AWS/Azure/GCP

Job description

Quantum Sky is seeking a Senior SIEM Engineer to own and evolve the Splunk deployment—architecture, data onboarding, CIM normalization, and platform health. You will drive detection engineering within Splunk ES and mentor mid-level engineers, aligning Splunk capabilities with leadership's security strategy.

The role requires on-site work in Washington, DC, with five days/week in the environment, core hours 8am–4pm, and a Top Secret clearance with SCI eligibility.