Splunk and Splunk SOAR Security Engineer

SGS Consulting; Austin (TX); Hybrid; USD 110,000 - 155,000; Full time

Job summary

SGS Consulting seeks a Splunk Engineer to administer the Splunk Enterprise environment and develop SOAR playbooks. You will manage indexers, search heads, forwarders, and data onboarding, ensuring health, performance, and availability.

The role requires 3+ years of hands-on Splunk administration, strong SPL, REST API experience, and a collaborative, hybrid work arrangement with 2 onsite days per week in Taylor, TX. Certification is a plus.

Qualifications

• 3+ years hands-on experience administering Splunk Enterprise.
• Strong experience with Splunk indexers, search heads, forwarders, and data onboarding.
• Direct experience building and maintaining Splunk SOAR playbooks.
• Direct experience integrating Splunk/SOAR with endpoint, vulnerability, or other security tools.
• Experience developing and troubleshooting REST API-based integrations.
• Strong SPL skills, including correlation searches, dashboard/report development, and system health monitoring.
• Splunk certifications such as Core Certified Power User, Admin, or SOAR preferred.
• Python or PowerShell scripting experience for SOAR automation preferred.
• Familiarity with security operations workflows and infrastructure build pipelines.
• Bachelor's degree preferred; equivalent combination may be considered.
• Hybrid work environment with 2 onsite days per week in Taylor, TX.

Responsibilities

• Administer and maintain the Splunk Enterprise environment, including indexers, search heads, forwarders, and data onboarding.
• Configure and manage Splunk indexes, source types, data inputs, and related ingestion components.
• Monitor search head and indexer health, system performance, and overall Splunk environment availability.
• Perform Splunk performance tuning and troubleshoot infrastructure and data ingestion issues.
• Build, maintain, test, and optimize Splunk SOAR playbooks.
• Manage SOAR applications, connectors, and integrations across the security technology stack.
• Automate security response workflows using Splunk SOAR playbooks.
• Integrate Splunk and SOAR with endpoint, vulnerability management, and other security tools.
• Develop and troubleshoot REST API-based integrations.
• Diagnose and resolve API, network, authentication, data ingestion, and integration issues.
• Develop and maintain SPL searches, correlation searches, dashboards, and reports.
• Support security monitoring and system health use cases within Splunk.
• Collaborate with security engineering teams to align Splunk/SOAR capabilities with detection and incident response priorities.
• Support security operations workflows including alert triage, incident response, and threat detection engineering.
• Support Splunk and SOAR upgrades, patching, maintenance, and operational changes.
• Assist with infrastructure and security service delivery workflows.
• Develop and maintain technical documentation covering Splunk/SOAR architecture, configurations, integrations, and playbooks.
• Create and maintain standard operating procedures to support consistent operations and knowledge transfer.
• Support custom SOAR application development and automation using scripting where required.
• Identify opportunities to improve security automation, detection, response, and operational efficiency.
• Work closely with cross-functional security and technology teams to resolve technical issues and deliver security solutions.

Skills

Splunk Enterprise Administration

Splunk SOAR

Splunk Indexers

Splunk Search Heads

Splunk Forwarders

Splunk Data Onboarding

Index and Source Type Management

SPL (Search Processing Language)

REST APIs

Python

PowerShell

Security Operations

Incident Response

Threat Detection Engineering

Automation

Education

Bachelor's degree in Cybersecurity, Computer Science, MIS, or related discipline preferred

Tools

Splunk Enterprise

Splunk SOAR

Endpoint Security Tools

Job description

Job Responsibilities:

• Administer and maintain the Splunk Enterprise environment, including indexers, search heads, forwarders, and data onboarding.
• Configure and manage Splunk indexes, source types, data inputs, and related ingestion components.
• Monitor search head and indexer health, system performance, and overall Splunk environment availability.
• Perform Splunk performance tuning and troubleshoot infrastructure and data ingestion issues.
• Build, maintain, test, and optimize Splunk SOAR playbooks.
• Manage SOAR applications, connectors, and integrations across the security technology stack.
• Automate security response workflows using Splunk SOAR playbooks.
• Integrate Splunk and SOAR with endpoint, vulnerability management, and other security tools.
• Develop and troubleshoot REST API-based integrations.
• Diagnose and resolve API, network, authentication, data ingestion, and integration issues.
• Develop and maintain SPL searches, correlation searches, dashboards, and reports.
• Support security monitoring and system health use cases within Splunk.
• Collaborate with security engineering teams to align Splunk/SOAR capabilities with detection and incident response priorities.
• Support security operations workflows including alert triage, incident response, and threat detection engineering.
• Support Splunk and SOAR upgrades, patching, maintenance, and operational changes.
• Assist with infrastructure and security service delivery workflows.
• Develop and maintain technical documentation covering Splunk/SOAR architecture, configurations, integrations, and playbooks.
• Create and maintain standard operating procedures to support consistent operations and knowledge transfer.
• Support custom SOAR application development and automation using scripting where required.
• Identify opportunities to improve security automation, detection, response, and operational efficiency.
• Work closely with cross-functional security and technology teams to resolve technical issues and deliver security solutions.

Skills:

• Splunk Enterprise Administration
• Splunk SOAR
• Splunk Indexers
• Splunk Search Heads
• Splunk Forwarders
• Splunk Data Onboarding
• Index and Source Type Management
• Splunk Performance Tuning
• SPL (Search Processing Language)
• Correlation Searches
• Dashboard and Report Development
• Splunk System Health Monitoring
• Splunk SOAR Playbook Development
• SOAR Automation
• Security Tool Integrations
• REST APIs
• API Integration
• Endpoint Security Integration
• Vulnerability Management Integration
• Network Troubleshooting
• Authentication Troubleshooting
• Python
• PowerShell
• Security Operations
• Incident Response
• Threat Detection Engineering
• Alert Triage
• Security Engineering
• Infrastructure Build Pipelines
• Technical Documentation
• SOP Development

Education / Experience:

3+ years of hands‑on experience administering Splunk Enterprise.

Strong experience with Splunk indexers, search heads, forwarders, and data onboarding.

Direct experience building and maintaining Splunk SOAR playbooks.

Direct experience integrating Splunk/SOAR with endpoint, vulnerability, or other security tools.

Experience developing and troubleshooting REST API-based integrations.

Strong troubleshooting skills involving APIs, networks, authentication, and security‑tool integrations.

Strong SPL skills, including correlation searches, dashboard/report development, and system health monitoring.

Splunk certifications such as Core Certified Power User, Certified Admin, or SOAR certifications are preferred.

Python or PowerShell scripting experience for SOAR automation or custom application development preferred.

Familiarity with security operations workflows, including alert triage, incident response, threat detection engineering, and infrastructure build pipelines.

Bachelor's degree in Cybersecurity, Computer Science, Management Information Systems (MIS), or a related discipline preferred.

Equivalent combination of education and professional experience may be considered.

Ability to work in a hybrid environment with 2 days onsite per week in Taylor, TX.