Splunk ES Engineer

Openkyber; Alaska; On-site; USD 85,000 - 120,000; Full time

Job summary

Openkyber seeks a security operations professional to monitor networks, endpoints, and cloud events, and to refine detection with Splunk searches and dashboards.

You will develop use cases from threat intel, onboard diverse data sources, and support audit readiness while collaborating with IT and security teams to respond to incidents.

Qualifications

• Experience configuring and tuning SIEM platforms such as Splunk.
• Ability to develop detection logic and alerts from threat intel.
• Familiarity with incident response lifecycle and forensics.

Responsibilities

• Threat Detection & Monitoring: Continuously monitor network traffic, endpoint logs, and cloud security events for anomalous behavior and potential security incidents.
• Splunk Management: Create, maintain, and tune Splunk correlation searches, alerts, and dashboards to minimize false positives and improve detection capabilities.
• Incident Response: Investigate potential security incidents, follow forensic evidence, and collaborate with IT and network teams to remediate threats.
• Use Case Development: Develop and refine detection and response playbooks based on threat intelligence and frameworks like MITRE ATT&CK.
• Log Integration: Work with infrastructure teams to onboard new data sources, ensuring log integrity, parsing, and normalization across the SIEM platform.
• Compliance & Reporting: Support audit readiness by collecting SIEM control evidence and generating compliance reports aligned with internal policies and standards.

Skills

Threat detection

Incident response

Security monitoring

Log analysis

Threat intelligence

Tools

Splunk

SIEM

Job description

Key Responsibilities:

• Threat Detection & Monitoring: Continuously monitor network traffic, endpoint logs, and cloud security events for anomalous behavior and potential security incidents.
• Splunk Management: Create, maintain, and tune Splunk correlation searches, alerts, and dashboards to minimize false positives and improve detection capabilities.
• Incident Response: Investigate potential security incidents, follow forensic evidence, and collaborate with IT and network teams to remediate threats.
• Use Case Development: Develop and refine detection and response playbooks based on threat intelligence and frameworks like MITRE ATT&CK.
• Log Integration: Work with infrastructure teams to onboard new data sources, ensuring log integrity, parsing, and normalization across the SIEM platform.
• Compliance & Reporting: Support audit readiness by collecting SIEM control evidence and generating compliance reports aligned with internal policies and standards.