Splunk Detection Engineer – On-site Idaho Falls

United Global Technologies; Idaho Falls (ID); On-site; USD 90,000 - 150,000; Full time

Job summary

United Global Technologies is seeking a skilled security data scientist to design, build, and tune detections using Splunk SPL and ES across diverse data sources. You will apply ML-based approaches with the AI Toolkit and DSDL to identify anomalies and threats.

The role requires collaboration with threat intel, incident response, and SOC teams to translate evolving threats into actionable detections, reduce false positives, and maintain detection-as-code workflows.

Qualifications

• Deep expertise in Splunk SPL: advanced search, data models, performance tuning.
• Hands-on Splunk ES experience: correlation searches, risk-based alerting, notable events, ES framework.
• Experience with Splunk AI Toolkit (AITK) for ML-based detections.
• Experience with Splunk App for Data Science and Deep Learning (DSDL) for custom models.
• Strong MITRE ATT&CK framework knowledge and mapping of detections.
• Familiarity with attack techniques and security data (EDR, network, cloud, identity).

Responsibilities

• Design, develop, and maintain detection content using SPL to identify threats across diverse data sources.
• Build and tune correlation searches, notable events, and risk-based alerting within Splunk Enterprise Security.
• Leverage the DSDL app to develop machine learning models for anomaly detection and threat identification.
• Apply the AITK and DSDL to create ML-driven detections beyond signatures.
• Map detection coverage to MITRE ATT&CK and identify visibility gaps.
• Collaborate with threat intelligence, IR, and SOC teams to translate threats into detections.
• Reduce false positives and alert fatigue through tuning and lifecycle management.
• Develop and maintain detection-as-code workflows with version control, testing, and CI/CD.
• Create documentation, runbooks, and detection specifications for downstream analysts.

Skills

Splunk SPL

Splunk ES

AI Toolkit

DSDL

MITRE ATT&CK

EDR data

Network data

Cloud data

Identity data

Tools

Git

CI/CD

Job description

United Global Technologies is seeking a skilled security data scientist to design, build, and tune detections using Splunk SPL and ES across diverse data sources. You will apply ML-based approaches with the AI Toolkit and DSDL to identify anomalies and threats.

The role requires collaboration with threat intel, incident response, and SOC teams to translate evolving threats into actionable detections, reduce false positives, and maintain detection-as-code workflows.