SIEM/Splunk Engineer - TS/SCI Cleared - 174468

Piper Companies; Newington (CT); On-site; USD 149,000 - 182,000; Full time

Benefits offered by this job

Medical benefits

Dental benefits

Vision benefits

PTO

Sick leave

Flexible schedule

Growth opportunities

Job summary

Zachary Piper Solutions seeks a Senior SIEM/Splunk Engineer for our Federal Program in Newington, VA, onsite 5 days a week. You will design, deploy, and optimize Splunk Enterprise and ES to support security monitoring, threat detection, and incident response.

Responsibilities include building scalable Splunk architectures, onboarding data, developing correlation searches, and automating tasks with Python, Bash, and Ansible.

Qualifications

• Bachelor’s degree or equivalent experience in cybersecurity, CS, IT, or related field.
• 5–10+ years of hands-on experience with Splunk Enterprise and Splunk ES.
• Experience designing, deploying, and supporting enterprise-scale Splunk environments.
• Expertise in SPL, dashboards, CIM mapping, and search optimization.
• Experience with Splunk SOAR (Phantom) and security automation.

Responsibilities

• Architect, deploy, administer, and optimize Splunk Enterprise, ES, and SOAR environments.
• Design scalable Splunk infrastructures with clustering, distributed search, and large-scale data ingestion.
• Configure data onboarding, CIM, and integrations across multiple data sources.
• Develop correlation searches, dashboards, data models, and MITRE-aligned detection content.
• Implement and maintain SOAR playbooks and automated response workflows.
• Perform health checks, capacity planning, upgrades, and modernization initiatives.
• Establish governance, RBAC, security hardening, and compliance requirements.
• Automate tasks using Ansible, Git, Python, Bash, and PowerShell.
• Collaborate with SOC/IR to improve detection and incident response workflows.
• Maintain architecture docs, procedures, and standards.

Skills

Splunk Enterprise

Splunk ES

SPL development

Python scripting

Linux/Unix

Git

Ansible

MITRE ATT&CK

Incident response

Threat detection

AWS/Azure/GCP

RBAC

Security clearance TS/SCI

Education

Bachelor’s degree in Cybersecurity, Computer Science, IT, or related field

Tools

Splunk SOAR

Phantom

Job description

Zachary Piper Solutions is seeking an Senior SIEM/Splunk to join a Federal Program located in Newington, VA, onsite 5 days per week. The SIEM/Splunk Engineer will serve as a subject matter expert for designing, implementing, tuning, and maintaining Splunk Enterprise and Enterprise Security to support enterprise-level security monitoring, threat detection, and incident response.

Responsibilities of the SIEM/Splunk Engineer:

• Architect, deploy, administer, and optimize Splunk Enterprise, Splunk Enterprise Security (ES), and Splunk SOAR environments.
• Design and maintain scalable, highly available Splunk infrastructures, including clustering, distributed search, and large-scale data ingestion.
• Configure and manage data onboarding, parsing, normalization, CIM compliance, and integrations across security, infrastructure, cloud, and application data sources.
• Develop and tune correlation searches, risk-based alerting (RBA), dashboards, data models, and MITRE ATT&CK-aligned detection content.
• Implement and maintain SOAR playbooks, automated response workflows, and integrations with security tools, cloud platforms, and ticketing systems.
• Perform health checks, performance tuning, capacity planning, upgrades, migrations, and platform modernization initiatives.
• Establish and maintain Splunk governance, RBAC, security hardening, compliance requirements, and operational standards.
• Automate deployments, configuration management, and administrative tasks using Ansible, Git, Python, Bash, and PowerShell.
• Collaborate with SOC and Incident Response teams to improve detection capabilities, investigation workflows, and overall security operations.
• Maintain architecture documentation, operational procedures, playbooks, and technical standards.

Qualifications of the SIEM/Splunk Engineer:

• Bachelor’s degree in Cybersecurity, Computer Science, IT, or related field (or equivalent experience)
• 5–10+ years of hands‑on experience with Splunk Enterprise and Splunk ES
• Experience designing, deploying, and supporting enterprise‑scale Splunk environments with clustering, high availability, and large‑volume data ingestion.
• Strong expertise in Splunk architecture, SPL development, dashboards, data models, CIM mapping, and search optimization.
• Experience with Splunk SOAR (Phantom), security automation, and orchestration workflows.
• Knowledge of SIEM operations, SOC processes, threat detection, incident response, and MITRE ATT&CK.
• Experience integrating security technologies including EDR/XDR, IDS/IPS, firewalls, cloud platforms (AWS/Azure/GCP), IAM, and threat intelligence feeds.
• Proficiency with Linux/Unix administration, networking fundamentals, scripting (Python, Bash, PowerShell), and automation tools such as Git and Ansible.
• Experience with security hardening, RBAC, SAML, TLS/SSL certificates, and enterprise security compliance requirements.
• Splunk certifications (Architect, Enterprise Admin, ES Admin, SOAR, or equivalent) strongly preferred.
• Active TS/SCI Security Clearance

Compensation for the SIEM/Splunk Engineer:

• Salary Range: $165,000+ *flexible based on experience*
• Comprehensive Benefits: Medical, Dental, Vision, PTO, and Sick Leave as required by law
• Flexible working schedule
• Unlimited opportunities for growth

Key Words: SIEM, splunk, bash, python, powershell, aws, azure, gcp, mitre, soar, phantom, tcp, udp, upgrades, migrations, edr, fw, ids, ips, cloud logs, cim, mapping, iam, ssl, splunk enterpise, splunk es, spl, configure, manage, engineer, federal, cleared, army, navy, air force, defense, clearance, government, models, dashboards, data models, soc, sme, playbooks, architecture, scripts, scripting, incident response