Splunk Detection Engineer

DivIHN Integration Inc; United States; Remote; USD 100,000 - 130,000; Full time

Job summary

A technology services company is seeking a Splunk Detection Engineer to ensure effective logging and security event detection. This fully remote role requires significant experience with Splunk Enterprise Security and event logging solutions, along with strong analytical skills. Collaborate with IT teams to develop detections and improve data quality. Ideal candidates will have scripting knowledge in Python/PowerShell/Bash and be comfortable under pressure.

Qualifications

• Significant experience with Splunk and Splunk Enterprise Security.
• Experience with ticketing/case management.
• Comfort with regex, JSON and APIs.

Responsibilities

• Ensure proper formatting, ingestion, tagging, and utilization of security logs.
• Collaborate with cybersecurity analysts to implement detections.
• Develop and maintain searches and dashboards in Splunk Enterprise Security.

Skills

Experience with Splunk

Event logging solutions

Analytical and problem-solving skills

Experience with Git pipelines

Linux CLI usage

Scripting in Python/PowerShell/Bash

Tools

Splunk Universal Forwarder

SOAR tools

Job description

Overview

Splunk Detection Engineer (Level IV or Strong Level III)

12+ months • Fully Remote

Scope: The Splunk Detection Engineer will play an important role in ensuring that security logs are appropriately formatted, ingested, tagged, and used to detect possible security events.

Typical tasks may include:

• Integrate new data sources, which may include databases, APIs, files, etc. This may involve setting standards and working with IT administrators to update their configurations
• Validating and creating appropriate configurations for CIM compliant logs
• Processing requests from cybersecurity analysts for new detections within Splunk Enterprise Security
• Analyzing existing logs to identify poorly formatted logs and potential gaps when implementing new detections
• Adding and maintaining threat feeds within Splunk Enterprise Security
• Monitoring the performance of and tuning detections
• Managing asset and identity inventory within Splunk Enterprise Security
• Creating and maintaining new Splunk apps
• Recommending additions or changes to Splunk or its data models to meet detection needs
• Developing searches, reports, and other functionalities for cyber-based use-cases, including active response, intrusion detection, vulnerability management, and related use cases

Responsibilities

• Carry out activities to ensure proper formatting, ingestion, tagging, and utilization of security logs for detection of events
• Collaborate with cybersecurity analysts and IT teams to implement detections and data models
• Develop and maintain detections, searches, and dashboards in Splunk Enterprise Security
• Drive continuous improvement of processes, data quality, and tooling related to Splunk
• Provide guidance and knowledge transfer to team members on Splunk Enterprise Security usage

Qualifications

Minimum Qualifications:

• Significant experience with Splunk and Splunk Enterprise Security
• Significant experience with event logging solutions (e.g., Splunk Universal Forwarder, syslog, Cribl)
• Experience with ticketing/case management
• Experience with Git pipelines
• Familiarity with using Linux CLI
• Ability to craft queries using common languages; comfort with regex, JSON and APIs; basic scripting in Python/PowerShell/Bash
• Excellent analytical, problem-solving, and communication skills both with stakeholders, peers, and internal customers; able to operate under pressure in a shift or on-call environment

Preferred Additional Qualifications:

• Strong grasp of TCP/IP, OSI model, and common protocols (HTTP, DNS, SMTP). Windows/Linux/macOS fundamentals; Active Directory/Azure AD concepts; basic cloud logging
• Experience in system and network administration
• Relevant cybersecurity experience including investigations and data analysis
• Experience with SOAR tools and automation development
• Experience using identity security/management tools (e.g., Entra ID, Active Directory, Shibboleth, CrowdStrike Identity Protection)
• Cloud security experience (e.g., CloudTrail/GuardDuty, Azure Defender/M365, GCP Security Command Center)