SIEM Detection & Threat Hunting Engineer (Splunk)

Coalfire Systems; Chicago (IL); Hybrid; USD 80,000 - 134,000; Full time

Job summary

Coalfire Systems is seeking a Detection and Response Engineer to join our Defensive Services team, focusing on SIEM monitoring, threat hunting, and purple team activities to meet federal and commercial security requirements.

Work closely with clients and internal teams to develop detections, tune alerts, and improve security posture across environments. The role emphasizes proactive defense, threat intelligence use, and incident response collaboration.

Qualifications

• Experience in threat intel collection, validation, and operationalization for detections.
• Hands-on in developing and tuning queries across multiple SIEMs in production.
• Ability to lead threat hunts and map findings to MITRE ATT&CK and runbooks.

Responsibilities

• Collect, analyze, and operationalize threat intel to drive proactive detection and hunts.
• Develop, optimize, and maintain SIEM queries, dashboards, and alerts.
• Plan and lead hypothesis-driven threat hunts; translate outcomes into improvements and runbooks.

Skills

Threat intelligence

SIEM monitoring

Threat hunting

Query development

Incident response

Documentation

Communication

Collaboration

MITRE ATT&CK

Detection as Code

Education

Splunk Enterprise Certified Administrator

Splunk Enterprise Security Certified Administrator

SumoLogic Administrator

Microsoft Security Operations Associate

Elastic Stack Certified Administrator

Tools

Splunk

Microsoft Sentinel

ELK stack

Sumo Logic

Terraform

Ansible

Job description

Coalfire Systems is seeking a Detection and Response Engineer to join our Defensive Services team, focusing on SIEM monitoring, threat hunting, and purple team activities to meet federal and commercial security requirements.

Work closely with clients and internal teams to develop detections, tune alerts, and improve security posture across environments. The role emphasizes proactive defense, threat intelligence use, and incident response collaboration.