Splunk Security Engineer

Robotics Technologies; Redmond (WA); Hybrid; USD 97,000 - 138,000; Full time

Job summary

Robotics Technologies in Redmond, WA seeks a seasoned Splunk Security Engineer to lead monitoring and detection engineering in a hybrid environment. You will administer Splunk Enterprise and Splunk Enterprise Security, expand enterprise log coverage, and improve detection quality across Windows, Linux, cloud, and network security.

The ideal candidate has 7–8 years of SIEM experience, hands-on Splunk expertise, and strong SPL development skills.

Qualifications

• 7-8 years of SIEM engineering and security monitoring.
• Hands-on experience with Splunk Enterprise and Splunk Enterprise Security.
• Expertise in SPL query development and troubleshooting.
• Experience onboarding and managing enterprise log sources.
• Strong knowledge of threat detection, threat hunting, and detection engineering.
• Experience developing and tuning SIEM alerts to reduce false positives.
• Strong understanding of Windows, Linux, networking, and cloud security.
• Knowledge of security operations, incident response, and threat intelligence.
• Familiarity with the MITRE ATT&CK framework.

Responsibilities

• Administer and optimize Splunk Enterprise and ES.
• Design Splunk architecture, including deployment and platform optimization.
• Integrate log sources across Windows, Linux, AD, AWS, Azure, GCP, and firewalls.
• Develop, maintain, and optimize SPL queries, dashboards, alerts, and reports.
• Collaborate with SOC and Incident Response teams during investigations.
• Support Splunk upgrades, migrations, deployment automation, and CI/CD.
• Prepare technical documentation and provide knowledge transfer to team members.

Skills

Splunk Enterprise

Splunk Enterprise Security

SPL

Python

Bash

SimpleXML

Threat hunting

Log analysis

Tools

Windows OS

Linux OS

Active Directory

AWS

Azure

GCP

EDR

CIM

CI/CD

Job description

Robotics Technologies is seeking a Splunk Security Engineer to support security monitoring and detection engineering in a hybrid environment based in Redmond, WA. In this role, you will administer and optimize Splunk Enterprise and Splunk Enterprise Security while expanding enterprise log coverage and improving the quality of detections and investigations.

Role focus

• Administer, configure, and maintain Splunk Enterprise and Splunk Enterprise Security (ES).
• Design and implement Splunk architecture, including deployment, configuration, and platform optimization.
• Integrate log sources across Windows, Linux, Active Directory, AWS, Azure, GCP, along with firewalls, EDR, IAM, and network security systems.

Detection engineering and monitoring

• Develop, maintain, and optimize SPL queries, dashboards, alerts, reports, and correlation searches.
• Configure log ingestion, parsing, normalization, indexing, and data retention policies.
• Troubleshoot log ingestion, parsing, indexing, CIM mapping, and data quality issues.
• Build automated security monitoring solutions using SPL, Python, Bash, and SimpleXML.
• Create detection rules and security use cases to strengthen threat detection capabilities and reduce operational noise.
• Perform proactive threat hunting using Splunk and security telemetry.
• Analyze security events to identify potential threats, vulnerabilities, and suspicious activity.
• Integrate threat intelligence feeds to improve monitoring and detection effectiveness.
• Conduct threat modeling using MITRE ATT&CK and Cyber Kill Chain.

Collaboration and platform operations

• Collaborate with SOC and Incident Response teams during security investigations.
• Monitor Splunk performance and optimize search efficiency, indexing, and data retention.
• Support Splunk upgrades, migrations, deployment automation, and CI/CD activities.
• Prepare technical documentation and provide knowledge transfer to team members.

Requirements

• 7-8 years of experience in SIEM engineering and security monitoring.
• Strong hands-on experience with Splunk Enterprise and Splunk Enterprise Security.
• Expertise in SPL query development and troubleshooting.
• Experience onboarding and managing enterprise log sources.
• Strong knowledge of threat detection, threat hunting, and detection engineering.
• Experience developing and tuning SIEM alerts to reduce false positives.
• Strong understanding of Windows, Linux, networking, and cloud security.
• Knowledge of security operations, incident response, and threat intelligence.
• Familiarity with the MITRE ATT&CK framework.

Location and job details

• Job ID: J54995
• Location: Redmond, WA
• Schedule: Redmond, WA / Dallas, TX (Hybrid - 3 Days Onsite per Week)
• Duration: 12 Months + Extension (12+ Months)
• Domain exposure: Oil & Gas
• Client: To Be Discussed Later; To be Disclosed
• Employment type: W-2, 1099, C2C

Work authorization

• US Citizen, Green Card, OPT-EAD, CPT, Other
• US Citizen, Green Card, OPT-EAD, CPT, H-1B, H4-EAD, Other

Technologies

• Splunk Enterprise, Splunk Enterprise Security, Splunk, SPL
• Python, Bash, SimpleXML
• MITRE ATT&CK, Cyber Kill Chain
• CIM, CI/CD
• Windows, Linux, Active Directory, AWS, Azure, GCP

Compensation

• Salary: USD 85 - 85 per hourly