Splunk ES SIEM Architect & SOC Lead

Accenture PLC; Oregon; Hybrid; USD 110,000 - 224,000; Full time

Job summary

Accenture Federal Services is seeking a Splunk Enterprise Security Subject Matter Expert to manage a large-scale Splunk deployment, ensuring architecture and platform health for substantial daily log ingestion across many endpoints. This role is pivotal for boosting SOC throughput through Splunk expertise and integrations.

You will onboard data sources, develop correlation rules mapped to the MITRE ATT&CK framework, and build SIEM-to-SOAR connections to automate alerts and responses, while

Qualifications

• 5 years of SIEM architecture/engineering experience.
• Bachelor's degree in Computer Science, Information Technology, or related field.

Responsibilities

• Own Splunk Enterprise Security architecture, sizing, and platform health management.
• Develop and tune correlation rules and use cases mapped to the MITRE ATT&CK framework.
• Onboard new log sources and normalize data across a large, diverse endpoint environment.
• Build and maintain SIEM-to-SOAR integrations that drive automated alert enrichment and response.
• Produce Splunk platform performance reporting and capacity‑planning recommendations.
• Support platform upgrades, patching, and lifecycle management.
• Train and mentor SOC analysts on Splunk use and best practices.
• Troubleshoot platform performance and data‑quality issues.

Skills

SIEM Architecture

Splunk SPL

SOC Operations

Log Onboarding

SOAR & Automation

Education

Bachelor's degree in Computer Science/IT

Tools

Splunk

Job description

Accenture Federal Services is seeking a Splunk Enterprise Security Subject Matter Expert to manage a large-scale Splunk deployment, ensuring architecture and platform health for substantial daily log ingestion across many endpoints. This role is pivotal for boosting SOC throughput through Splunk expertise and integrations.

You will onboard data sources, develop correlation rules mapped to the MITRE ATT&CK framework, and build SIEM-to-SOAR connections to automate alerts and responses, while