Splunk Security & Detection Engineer

Net56; Ela Township (IL); Presencial; USD 150.000 - 170.000; Jornada completa

Descripción de la vacante

Net56, Inc. is seeking a Splunk Engineer to design, deploy, and maintain a distributed Splunk environment across on-premises, cloud, and client infrastructures.

The role focuses on onboarding diverse data sources, creating dashboards and correlation searches, and automating threat detection and incident triage workflows, bridging platform engineering with security operations.

Formación

• Bachelor's degree in IT/CS/cybersecurity or equivalent experience.
• Minimum 5 years of experience in a security engineering/Data Analytics role.
• Proficiency with Splunk platform, CIM, and incident triage workflows.

Responsabilidades

• Design, deploy, and maintain distributed Splunk environment across on-prem, cloud, and client infra.
• Develop dashboards, alerts, and correlation searches to improve threat visibility.
• Onboard diverse data sources (firewalls, endpoints, cloud services) and ensure data quality.
• Automate detection and triage workflows using Python/Bash/PowerShell.
• Collaborate with cross-functional teams and document runbooks and topology.

Conocimientos

Splunk expertise

Threat detection

Incident triage

Python/Bash/PowerShell

Linux/Windows admin

Educación

Bachelor's Degree in IT/CS/Cybersecurity

Herramientas

Splunk Enterprise

Splunk Enterprise Security

SOAR

Splunk DB Connect

Descripción del empleo

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Splunk Security & Detection Engineer

6 days ago Requisition ID: 1047

Salary Range: $150,000.00 To $170,000.00 Annually

Splunk Security & Detection Engineer

Department: Network Operations & Security Center

Reports To: CTO

Employment Type: Full-Time

Position Summary

Net56 is seeking a skilled Splunk Engineer to join our Network Operations and Security Center team. This role is responsible for the design, deployment, operational maintenance, and optimization of our distributed Splunk environment across on-premises, cloud, and client infrastructures.

The Splunk Engineer will bridge platform engineering and security operations by onboarding diverse data sources (firewalls, switches, endpoints, cloud services), architecting custom dashboards and correlation searches and automating threat detection and incident triage workflows.

Key Responsibilities

Platform Administration & Data Onboarding

• Build, deploy, administer, and maintain a distributed Splunk architecture (Splunk Enterprise SEIM/Enterprise Security /SOAR) across Windows and Linux environments.
• Manage, configure, and maintain multi-site indexer clusters, data routing, parsing, and event normalization per the Splunk Common Information Model (CIM).
• Onboard diverse log sources via Universal Forwarders, scripted inputs, Syslog/TCP/UDP, modular inputs, REST APIs, and Splunk DB Connect.
• Edit and maintain Splunk configuration and custom applications.
• Monitor cluster health, resource utilization, indexing rates, and search performance to optimize license efficiency and search runtimes.

Content Development & Detection Engineering

• Develop, tune, and maintain custom Splunk correlation searches, alerts, and investigative dashboards to enhance real-time visibility and threat detection accuracy.
• Map detections to industry standards (MITRE ATT&CK, NIST 800-53, CIS Controls) to continuously lower false-positive rates and prevent alert fatigue.
• Integrate Splunk with network network infrastructure devices, identity providers, and cloud environments.
• Create regular expressions (regex) and automated scripts (Python, Bash, PowerShell) to accelerate log parsing, IOC extraction, and administrative tasks.

Operations, Collaboration & Compliance

• Act as an escalation engineer for complex event monitoring, log gap analysis, and incident investigations.
• Collaborate with Network Infrastructure Engineers, Systems Administrators, and client-facing teams to configure and validate new data feeds.
• Produce and maintain comprehensive technical documentation, network topology/data flow diagrams, SOPs, and runbooks.
• Deep proficiency with Splunk CLI, configuration file architecture, and data parsing pipelines.
• Strong knowledge of enterprise networking fundamentals: TCP/IP, UDP, routing/switching, VLANs, firewalls, and NAT.
• Solid administration background in both Linux (RHEL) and Windows Server operating systems.
• Hands-on scripting capability in Python, Bash, or PowerShell for API data inputs and automation.
• Experience aligning detections with security frameworks (NIST, CIS, MITRE ATT&CK).

Candidate Qualifications & Requirements

• Must currently reside within a 30-minute driving distance of Deer Park, IL.
• Education: Bachelor's Degree in Information Technology, Computer Science, Cybersecurity, or related field (or equivalent practical experience).
• 5 years' experience required.

Certifications

• Splunk Certification required:Must have a current Splunk Enterprise Certified Admin certification minimum. Preferred: Splunk Enterprise Certified Architect
• Preferred Security & Infrastructure Certifications (One or more): CompTIA Security+, CySA+, CASP+, Cisco CCNA/CCNP (Security or Enterprise), Palo Alto PCNSA/PCNSE, Check Point CCSA, Fortinet NSE, or (ISC)² SSCP/CISSP.