SIEM Engineer / Splunk Engineer

Morph Enterprise; Harrisburg (Dauphin County); Hybrid; USD 110,000 - 150,000; Full time

Benefits offered by this job

Hybrid work model

Onsite in Harrisburg

Job summary

Morph Enterprise is seeking an experienced SIEM Engineer / Splunk Engineer to support an enterprise SIEM environment. You will configure, integrate, and optimize Splunk to enhance security monitoring, threat detection, and incident response.

The role involves onboarding data sources, developing detection content, and close collaboration with SOC, infrastructure, cloud, and applications teams to keep logging healthy and actionable.

Qualifications

• Hands-on Splunk/SIEM experience in enterprise environments.
• Strong knowledge of security log collection, parsing, normalization, indexing and retention.
• Experience creating detection content, alerts, dashboards and correlation rules.

Responsibilities

• Engineer and optimize the enterprise SIEM platform (Splunk) and related security tools.
• Onboard data sources; ensure logs are collected, parsed and indexed correctly.
• Develop correlation searches, alerts, dashboards and reports for threat detection.
• Collaborate with SOC, infrastructure, cloud, networking and apps teams.
• Support platform upgrades, changes, and technical documentation.

Skills

Splunk

SIEM

Threat detection

Log management

Dashboards

Tools

SPL

Job description

Location: Harrisburg, PA 17120

Interview Type: In-person

Job Summary

We are seeking an experienced SIEM Engineer / Splunk Engineer to provide specialized engineering support for an enterprise Security Information and Event Management (SIEM) environment. The ideal candidate will have hands‑on experience with Splunk, security log management, threat detection, alert development, and SIEM platform administration.

The candidate will be responsible for configuring, integrating, maintaining, and optimizing the SIEM platform to enhance enterprise security monitoring, threat detection, incident response, and log management capabilities. This role involves close collaboration with Security Operations Center (SOC) analysts and infrastructure, cloud, networking, and application teams.

Key Responsibilities

• Engineer, configure, maintain, and optimize the enterprise SIEM platform, including Splunk and related security technologies.
• Onboard new data sources and ensure security logs are properly collected, parsed, normalized, indexed, and retained.
• Develop and maintain correlation searches, alerts, dashboards, reports, detection rules, and security monitoring content.
• Integrate SIEM capabilities with security tools, cloud platforms, applications, infrastructure, and enterprise systems.
• Monitor SIEM platform performance, capacity, availability, and overall system health.
• Troubleshoot technical issues related to log ingestion, indexing, data parsing, and platform performance.
• Tune alerts and detection logic to reduce false positives and improve threat detection effectiveness.
• Provide technical support to SOC analysts and incident response personnel through queries, dashboards, and investigative capabilities.
• Support platform upgrades, patches, configuration changes, testing, and implementation of supporting SIEM infrastructure.
• Develop and maintain technical documentation, operational procedures, system configurations, and knowledge-transfer materials.
• Collaborate with SOC, infrastructure, cloud, networking, and application teams on SIEM-related initiatives.
• Follow established security standards, change-management procedures, and applicable cybersecurity policies.

Required Skills and Qualifications

• Hands‑on experience with SIEM platforms, particularly Splunk.
• Experience configuring, administering, monitoring, and troubleshooting Splunk.
• Strong knowledge of security log collection, parsing, normalization, indexing, and retention.
• Experience developing SIEM searches, alerts, dashboards, reports, and correlation rules.
• Knowledge of cybersecurity monitoring, threat detection, and security event analysis.
• Experience integrating SIEM platforms with enterprise applications, infrastructure, cloud platforms, and security tools.
• Ability to troubleshoot SIEM performance, data ingestion, and system availability issues.
• Strong analytical, problem‑solving, documentation, and communication skills.
• Ability to collaborate effectively with security operations and technical infrastructure teams.

Preferred Qualifications

• Experience with Splunk Enterprise Security and Splunk Search Processing Language (SPL).
• Experience tuning security alerts and improving detection logic.
• Familiarity with SOC operations and incident response processes.
• Experience supporting SIEM upgrades, patches, configuration changes, and testing.
• Knowledge of enterprise cybersecurity standards and change‑management processes.

Work Location and Interview Requirements

• Location: Keystone Building, 5th Floor, Harrisburg, PA 17120.
• Work Arrangement: Hybrid, with three days onsite per week.
• Interview Process: In-person interview.

Ideal Candidate Profile

The ideal candidate is a hands‑on SIEM or Splunk Engineer with experience maintaining enterprise security monitoring platforms, onboarding log sources, developing detection content, troubleshooting technical issues, and supporting SOC operations.