Splunk Security & Detection Engineer

ADP, Inc.; Deer Park (IL); On-site; USD 150,000 - 170,000; Full time

Job summary

Net56 is seeking a skilled Splunk Engineer to design, deploy, and operate a distributed Splunk environment across on-premises, cloud, and client infrastructures.

You will develop dashboards, correlation searches, and automated detections while mapping detections to MITRE ATT&CK, NIST 800-53, and CIS Controls. Collaboration with security operations and network teams is essential for incident triage and ongoing optimization.

Qualifications

• Bachelor’s degree in IT, CS, Cybersecurity, or related field.
• 5+ years of relevant experience.
• Splunk Enterprise Certified Admin is required; Architect preferred.
• Knowledge of MITRE ATT&CK, NIST 800-53, CIS Controls.

Responsibilities

• Design, deploy, and maintain a distributed Splunk environment across on-prem, cloud, and client infrastructures.
• Develop dashboards and correlation searches; automate threat detection and incident triage workflows.
• Collaborate with security and network teams; ensure compliance and documentation (SOPs, runbooks).
• Escalate incidents and document topology and data flows; maintain Splunk CLI and parsing pipelines.

Skills

Splunk

Scripting (Python/Bash/PowerShell)

Linux administration

Windows Server administration

Networking fundamentals

Education

Bachelor’s Degree in Information Technology, Computer Science, Cybersecurity, or related field

Tools

Splunk

Splunk Enterprise

REST APIs

Job description

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Splunk Security & Detection Engineer

2 days ago Requisition ID: 1047

Salary Range: $150,000.00 To $170,000.00 Annually

Splunk Security & Detection Engineer

Department: Network Operations & Security Center

Reports To: CTO

Employment Type: Full-Time

Position Summary

Net56 is seeking a skilled Splunk Engineer to join our Network Operations and Security Center team. This role is responsible for the design, deployment, operational maintenance, and optimization of our distributed Splunk environment across on-premises, cloud, and client infrastructures.

The Splunk Engineer will bridge platform engineering and security operations by onboarding diverse data sources (firewalls, switches, endpoints, cloud services), architecting custom dashboards and correlation searches and automating threat detection and incident triage workflows.

Key Responsibilities

Platform Administration & Data Onboarding

• Build, deploy, administer, and maintain a distributed Splunk architecture (Splunk Enterprise SEIM/Enterprise Security /SOAR) across Windows and Linux environments.
• Manage, configure, and maintain multi-site indexer clusters, data routing, parsing, and event normalization per the Splunk Common Information Model (CIM).
• Onboard diverse log sources via Universal Forwarders, scripted inputs, Syslog/TCP/UDP, modular inputs, REST APIs, and Splunk DB Connect.
• Edit and maintain Splunk configuration and custom applications.
• Monitor cluster health, resource utilization, indexing rates, and search performance to optimize license efficiency and search runtimes.

Content Development & Detection Engineering

• Develop, tune, and maintain custom Splunk correlation searches, alerts, and investigative dashboards to enhance real-time visibility and threat detection accuracy.
• Map detections to industry standards (MITRE ATT&CK, NIST 800-53, CIS Controls) to continuously lower false-positive rates and prevent alert fatigue.
• Integrate Splunk with network network infrastructure devices, identity providers, and cloud environments.
• Create regular expressions (regex) and automated scripts (Python, Bash, PowerShell) to accelerate log parsing, IOC extraction, and administrative tasks.

Operations, Collaboration & Compliance

• Act as an escalation engineer for complex event monitoring, log gap analysis, and incident investigations.
• Collaborate with Network Infrastructure Engineers, Systems Administrators, and client-facing teams to configure and validate new data feeds.
• Produce and maintain comprehensive technical documentation, network topology/data flow diagrams, SOPs, and runbooks.
• Deep proficiency with Splunk CLI, configuration file architecture, and data parsing pipelines.
• Strong knowledge of enterprise networking fundamentals: TCP/IP, UDP, routing/switching, VLANs, firewalls, and NAT.
• Solid administration background in both Linux (RHEL) and Windows Server operating systems.
• Hands-on scripting capability in Python, Bash, or PowerShell for API data inputs and automation.
• Experience aligning detections with security frameworks (NIST, CIS, MITRE ATT&CK).

Candidate Qualifications & Requirements

• Must currently reside within a 30-minute driving distance of Deer Park, IL.
• Education: Bachelor’s Degree in Information Technology, Computer Science, Cybersecurity, or related field (or equivalent practical experience).
• 5 years’ experience required.

Certifications

• Splunk Certification required:Must have a current Splunk Enterprise Certified Admin certification minimum. Preferred: Splunk Enterprise Certified Architect
• Preferred Security & Infrastructure Certifications (One or more): CompTIA Security+, CySA+, CASP+, Cisco CCNA/CCNP (Security or Enterprise), Palo Alto PCNSA/PCNSE, Check Point CCSA, Fortinet NSE, or (ISC)² SSCP/CISSP.