Splunk Dashboard Engineer

Expert Technology Services; Morrisville (NC); On-site; USD 110,000 - 150,000; Full time

Job summary

Expert Technology Services is seeking a Splunk Detection and Incident Response Dashboard Engineer to design, build, and maintain dashboards for SOC incident detection, investigation, and response workflows.

You will develop dashboards for key security metrics, optimize Splunk searches, and surface suspicious activity across logs to enable efficient investigations. Collaborate with Detection Engineers, Incident Responders, and SOC Analysts to translate threats into actionable dashboards.

Responsibilities

• Design, build, and maintain Splunk dashboards for SOC incident detection and response workflows.
• Develop dashboards for key security metrics, optimize Splunk searches, and surface activity across logs to enable investigations.
• Collaborate with Detection Engineers, Incident Responders, and SOC Analysts to translate threats into actionable dashboards.

Job description

Job Summary for Splunk Detection and Incident Response Dashboard Engineer

• Design, build, and maintain Splunk dashboards to support Security Operations Center (SOC) incident detection, investigation, and response workflows.
• Develop visualizations and dashboards for key security metrics, including incident volume/severity, Mean Time to Detect (MTTD), Mean Time to Respond/Resolve (MTTR), and alert fidelity/false positive trends.
• Build and optimize Splunk searches, reports, and panels to surface suspicious activity, detections, and notable security events.
• Collaborate closely with Detection Engineers, Incident Responders, and SOC Analysts to understand use cases, threats, and investigation requirements.
• Ensure dashboards are aligned with SOC workflows, enabling analysts to efficiently transition from visualizations to investigations.
• Enhance dashboard performance and usability by refining searches and optimizing data models for security analytics.
• Document dashboard logic, metric definitions, and assumptions to ensure clarity and consistency in operations.
• Leverage experience with security data sources such as authentication logs, endpoint telemetry, network logs, and application security logs.
• Transform unstructured security data into actionable visual insights for SOC operations.
• Apply strong analytical skills and attention to detail to ensure accuracy and effectiveness of dashboards and reports.