Senior Splunk UEBA Engineer (DoD/TS-SCI)

Peraton; United States; On-site; USD 86,000 - 138,000; Full time

Job summary

Peraton is seeking a Splunk Engineer to design, administer, and optimize an enterprise Splunk environment with a focus on User and Entity Behavior Analytics (UEBA). The role supports SITEC 3 EOM at MacDill AFB, FL, working with SOC teams to detect anomalies and protect critical networks.

The engineer will use UEBA, CIM, and ML models to identify insider threats and account compromise, ensuring data is modeled and actionable for security operations. Strong collaboration across teams is required.

Qualifications

• Must have DoD 8570 IAT II Certification.
• DoD TS/SCI clearance required.
• Minimum education aligned with DoD standards per position.

Responsibilities

• Lead the design, engineering and deployment of Splunk User Behavior Analytics (UBA).
• Ingest identity-centric data sources (Active Directory, VPN, Cloud, HR systems).
• Develop machine learning models to baseline normal user behavior.
• Collaborate with Insider Threat and SOC teams to identify anomalies.
• Perform data normalization using Splunk CIM for UEBA.
• Integrate UEBA anomalies into Splunk Enterprise Security dashboards and SOAR playbooks.
• Monitor UEBA health and troubleshoot performance.

Skills

IAT II Certification

DoD TS/SCI clearance

Python

Bash

Education

High school diploma

AS/AA degree

BS/BA degree

MS/MA degree

PhD

Tools

Python

Splunk

Splunk CIM

Job description

Peraton is seeking a Splunk Engineer to design, administer, and optimize an enterprise Splunk environment with a focus on User and Entity Behavior Analytics (UEBA). The role supports SITEC 3 EOM at MacDill AFB, FL, working with SOC teams to detect anomalies and protect critical networks.

The engineer will use UEBA, CIM, and ML models to identify insider threats and account compromise, ensuring data is modeled and actionable for security operations. Strong collaboration across teams is required.