Splunk Security Engineer (Enterprise and SOAR)

MWResource; Austin (TX); Hybrid; USD 124,000 - 165,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Disability insurance

Life insurance

401K plan

Background check

Drug screening

US work authorization

Job summary

MWResource is seeking a contract Splunk Security Engineer to administer and optimize Splunk Enterprise and Splunk SOAR environments. The role covers data onboarding, health monitoring, and performance tuning, with emphasis on building SOAR playbooks and integrating with security tools.

The candidate will work in a hybrid Austin area setting, 2 onsite days weekly, and participate in upgrades, incident response support, and knowledge transfer through documentation.

Qualifications

• 3+ years hands-on Splunk Enterprise administration.
• Experience building Splunk SOAR playbooks.
• Experience integrating Splunk/SOAR with security tools.
• Experience with REST API-based integrations.
• Experience troubleshooting API, network, and authentication issues.
• Strong SPL skills for correlation searches and dashboards.

Responsibilities

• Manage and maintain Splunk Enterprise for data onboarding, index management, health, and performance tuning.
• Build and maintain Splunk SOAR playbooks and integrations.
• Support upgrades, patching, and service delivery workflows.
• Document architecture, playbooks, and procedures.

Skills

Splunk Enterprise

Splunk SOAR

Security integrations

REST APIs

Troubleshooting

SPL / Dashboards

Education

Bachelor's Degree in Cyber Security

Bachelor's Degree in CS or MIS or related

Tools

Python

PowerShell

Job description

Job Description

JOB-2472

Hybrid: Austin Metro Area, TX (2 days onsite required)

Duration: 2 years

Seeking a contract Splunk Security Engineer to take on day-to-day administration, engineering, and operational support for our Splunk Enterprise and Splunk SOAR environments.

Responsibilities

The contractor will manage and maintain the Splunk Enterprise environment, including data onboarding, index and source type management, search head and indexer health, and performance tuning. On the SOAR side, they'll build and maintain playbooks, manage app/connector integrations, and support automation of playbooks across the broader security stack. The role also includes troubleshooting data ingestion issues, supporting upgrades and patching, and working with the broader security engineering team to align Splunk/SOAR use cases with company's detection and response priorities, and service delivery workflows. Documentation of architecture, playbooks, and standard operating procedures will be expected to support knowledge transfer.

Required qualifications

• 3+ years hands-on experience administering Splunk Enterprise (indexers, search heads, forwarders, data onboarding)
• Direct experience building and maintaining Splunk SOAR playbooks
• Direct experience integrating Splunk/SOAR with endpoint, vulnerability, or other security tool
• Experience with REST API-based integrations
• Experience troubleshooting issues related to API, network, authentication and other integrations
• Strong SPL skills, including correlation searches, dashboard/report development, and system health monitoring

Preferred qualifications

• Splunk certifications (Core Certified Power User, Certified Admin, or SOAR-specific certs)
• Scripting experience (Python, PowerShell) to support custom SOAR app development or automation
• Familiarity with security operations workflows: infrastructure build pipelines, alert triage, incident response, threat detection engineering

Education

• Bachelor's Degree: Cyber Security, Computer Science, MIS, or related discipline (Preferred)
• or a combination of education and experience that provides equivalent knowledge to a major in such fields is required

Benefits

• The base pay range for this role is $90 - $120/hour.
• medical, dental and vision coverage through Florida Blue
• short- and long-term disability coverage
• employer paid life insurance
• participation in the MWResource 401K plan for US based consultants
• MWResource does not discriminate based on race, gender, color, religion, national origin, age, disability, veteran status, or anything else that makes you part of any group.
• Candidates must be authorized to work in the United States.
• Candidates will be required to pass a background check and drug screening.