Splunk Security & Detection Engineer

Net56, Inc.; Deer Park (TX); Presencial; USD 150.000 - 170.000; Jornada completa

Descripción de la vacante

Net56, Inc. is seeking a skilled Splunk Security & Detection Engineer to join our Network Operations and Security Center. You will design, deploy, and optimize a distributed Splunk environment across on-premises, cloud, and client infrastructures.

You will onboard diverse data sources, architect dashboards, and automate threat detection and incident triage workflows, bridging platform engineering with security operations. Strong scripting in Python or PowerShell is expected.

Formación

• Bachelor's degree in IT/CS/Cybersecurity or related field is required.
• 5 years’ experience required in security operations or Splunk environments.
• Must be able to onboard data sources and develop detection logic.

Responsabilidades

• Design, deploy, and maintain distributed Splunk environment across Windows and Linux.
• Develop custom dashboards, correlation searches, and alerts for threat detection.
• Collaborate with security and network teams to validate data feeds and runbooks.

Conocimientos

Threat detection

Data onboarding

Scripting

Collaboration

Python

Educación

Bachelor's Degree in Information Technology, Computer Science, Cybersecurity, or related field

Herramientas

Splunk Enterprise

Splunk CIM

Splunk CLI

Regex

Descripción del empleo

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Splunk Security & Detection Engineer

3 days ago Requisition ID: 1047

Salary Range: $150,000.00 To $170,000.00 Annually

Splunk Security & Detection Engineer

Department: Network Operations & Security Center

Reports To: CTO

Employment Type: Full-Time

Position Summary

Net56 is seeking a skilled Splunk Engineer to join our Network Operations and Security Center team. This role is responsible for the design, deployment, operational maintenance, and optimization of our distributed Splunk environment across on-premises, cloud, and client infrastructures.

The Splunk Engineer will bridge platform engineering and security operations by onboarding diverse data sources (firewalls, switches, endpoints, cloud services), architecting custom dashboards and correlation searches and automating threat detection and incident triage workflows.

Platform Administration & Data Onboarding

• Build, deploy, administer, and maintain a distributed Splunk architecture (Splunk Enterprise SEIM/Enterprise Security /SOAR) across Windows and Linux environments.
• Manage, configure, and maintain multi-site indexer clusters, data routing, parsing, and event normalization per the Splunk Common Information Model (CIM).
• Onboard diverse log sources via Universal Forwarders, scripted inputs, Syslog/TCP/UDP, modular inputs, REST APIs, and Splunk DB Connect.
• Edit and maintain Splunk configuration and custom applications.
• Monitor cluster health, resource utilization, indexing rates, and search performance to optimize license efficiency and search runtimes.

Content Development & Detection Engineering

• Develop, tune, and maintain custom Splunk correlation searches, alerts, and investigative dashboards to enhance real-time visibility and threat detection accuracy.
• Map detections to industry standards (MITRE ATT&CK, NIST 800-53, CIS Controls) to continuously lower false-positive rates and prevent alert fatigue.
• Integrate Splunk with network network infrastructure devices, identity providers, and cloud environments.
• Create regular expressions (regex) and automated scripts (Python, Bash, PowerShell) to accelerate log parsing, IOC extraction, and administrative tasks.

Operations, Collaboration & Compliance

• Act as an escalation engineer for complex event monitoring, log gap analysis, and incident investigations.
• Collaborate with Network Infrastructure Engineers, Systems Administrators, and client-facing teams to configure and validate new data feeds.
• Produce and maintain comprehensive technical documentation, network topology/data flow diagrams, SOPs, and runbooks.
• Deep proficiency with Splunk CLI, configuration file architecture, and data parsing pipelines.
• Strong knowledge of enterprise networking fundamentals: TCP/IP, UDP, routing/switching, VLANs, firewalls, and NAT.
• Solid administration background in both Linux (RHEL) and Windows Server operating systems.
• Hands-on scripting capability in Python, Bash, or PowerShell for API data inputs and automation.
• Experience aligning detections with security frameworks (NIST, CIS, MITRE ATT&CK).

Candidate Qualifications & Requirements

• Must currently reside within a 30-minute driving distance of Deer Park, IL.
• Education: Bachelor’s Degree in Information Technology, Computer Science, Cybersecurity, or related field (or equivalent practical experience).
• 5 years’ experience required.

Certifications

• Splunk Certification required:Must have a current Splunk Enterprise Certified Admin certification minimum. Preferred: Splunk Enterprise Certified Architect
• Preferred Security & Infrastructure Certifications (One or more): CompTIA Security+, CySA+, CASP+, Cisco CCNA/CCNP (Security or Enterprise), Palo Alto PCNSA/PCNSE, Check Point CCSA, Fortinet NSE, or (ISC)² SSCP/CISSP.