SIEM Subject Matter Expert (Splunk)

accenturefederalservices; United States; Remote; USD 140,000 - 210,000; Full time

Job summary

Accenture Federal Services is seeking an experienced SIEM architect to own the architecture and ongoing health of a large Splunk Enterprise Security deployment supporting security monitoring across many endpoints. You will improve how the SOC collects and analyzes security data, develop detections, and automate alert handling while guiding platform lifecycle management.

You will manage Splunk ES architecture, tuning, and performance, create and tune correlation rules aligned with MITRE ATT&CK,

Qualifications

• SIEM architecture experience including large deployments.
• Bachelor’s degree or equivalent experience.
• Deep knowledge of Splunk architecture and SPL.
• Experience integrating SIEM with SOAR for automated response.
• Splunk Certified Architect certification and Splunk Enterprise Security Certified Admin certification.

Responsibilities

• Manage Splunk Enterprise Security architecture, sizing, performance, and overall platform health.
• Create and tune correlation rules and detection use cases aligned with the MITRE ATT&CK framework.
• Add log sources and normalize data across a varied endpoint environment.
• Build and maintain SIEM-to-SOAR integrations for automated alert enrichment and response.
• Report on performance and recommend capacity needs.
• Support upgrades, patching, and platform lifecycle work; resolve performance and data-quality issues.
• Train and mentor SOC analysts on Splunk practices.

Skills

SIEM architecture

Splunk SPL

Data onboarding

SOAR integration

Mentoring analysts

Education

Bachelor's degree in CS/IT

Tools

Splunk Certified Architect

Splunk Enterprise Security Certified Admin

Splunk

SOAR platforms

Job description

Role overview

Own the architecture and ongoing health of a large Splunk Enterprise Security deployment supporting security monitoring across many endpoints. You will improve how the SOC collects and analyzes security data, develops detections, and automates alert handling. The role also includes platform lifecycle management and helping analysts use the system effectively.

Responsibilities

• Manage Splunk Enterprise Security architecture, sizing, performance, and overall platform health.


• Create and tune correlation rules and detection use cases aligned with the MITRE ATT&CK framework.


• Add log sources and normalize data across a varied endpoint environment.


• Build and maintain SIEM-to-SOAR integrations for automated alert enrichment and response.


• Report on performance and recommend capacity needs.


• Support upgrades, patching, and platform lifecycle work; resolve performance and data-quality issues.


• Train and mentor SOC analysts on Splunk practices.

Requirements

• At least 5 years of SIEM architecture or engineering experience, including large deployments with substantial daily data volumes.


• Bachelor’s degree in computer science, information technology, or a related field; equivalent experience may be considered.


• Deep knowledge of Splunk architecture, Search Processing Language (SPL), and data onboarding.


• Experience integrating SIEM systems with SOAR platforms for automated response.


• Splunk Certified Architect certification, or Splunk Enterprise Security Certified Admin certification.