Splunk SOAR Administrator

G2IT, LLC.; Suitland (MD); On-site; USD 130,000 - 190,000; Full time

Job summary

G2IT, LLC. in Suitland, MD seeks a Splunk SOAR Administrator to provide engineering, operations, and technical support for SIEM platforms supporting threat detection and incident management for a government program. The role emphasizes automation and secure operations.

The ideal candidate holds a TS/SCI clearance, IAT Level III (CISSP), and 6–10+ years in CND and Splunk-related work, with strong collaboration across teams and adherence to standards such as MITRE ATT&CK and NIST guidelines.

Qualifications

• Bachelor's degree or higher in CS/IT/Info Assurance with 8+ years of relevant experience; or Master's with 6+ years.
• Active TS/SCI security clearance.
• Active IAT Level III certification (e.g., CISSP).
• 8+ years of engineering experience supporting Computer Network Defense (CND).
• 6+ years of experience with Splunk including Add-ons, Apps, TAs, and Universal Forwarder.
• Expert knowledge of Splunk products (Enterprise, Enterprise Security, SOAR).
• Strong SDLC experience; analytical and problem-solving skills.
• Excellent verbal and written communication skills.

Responsibilities

• Design, deploy, and maintain backend architecture.
• Administer the SOAR platform with configurations and integrations.
• Develop and maintain automated SOAR playbooks for alert triage and response.
• Integrate SOAR with Splunk ES, ticketing systems, and threat feeds.
• Manage clustering, replication, indexing performance, and licensing.
• Apply DISA STIGs, SRGs, and NAVINTEL baselines.
• Maintain version control, approval workflows, and playbook governance.
• Configure secure transmission of Audit.XML records and troubleshoot transmissions.
• Implement incident response workflows aligned with MITRE ATT&CK, NIST SP 800-61, HGCC procedures.

Skills

Splunk

SOAR administration

Security operations

Incident response

Communication skills

Networking basics

Education

Bachelor's degree in CS/IT/Info Assurance

Master's degree in related field

10+ years LAN/WAN experience in lieu of degree

Tools

Splunk Add-ons

Splunk Apps

Universal Forwarder

SIEM integration

Job description

We are hiring a Splunk SOAR Administrator to join our team in Suitland, MD. In this role, you will provide engineering, operations, and technical support for Security Information and Event Management (SIEM) platforms that support threat detection, compliance, and security incident management for the Office of Naval Intelligence's Hopper Global Communications Center (HGCC). You will help develop and automate cybersecurity operations while supporting mission critical defensive cyber capabilities.

Primary Responsibilities

• Design, deploy, and maintain EAC backend architecture.
• Administer the SOAR platform, including configuration, asset integrations, and custom fields.
• Design, develop, test, and maintain automated SOAR playbooks for alert triage, enrichment, and risk based response.
• Integrate SOAR with Splunk Enterprise Security, ticketing systems, and threat intelligence feeds.
• Manage clustering, replication, indexing performance, and license usage.
• Apply DISA STIGs, SRGs, and NAVINTEL Information Assurance baselines.
• Maintain version control, approval workflows, and playbook governance.
• Configure and maintain the secure transmission of Audit.XML records to Intelligence Community partners through ITS and troubleshoot transmission failures.
• Implement standard incident response workflows aligned with MITRE ATT&CK, NIST SP 800-61, and HGCC N62 Defensive Cyber Operations procedures.
• Travel may be required between the National Maritime Intelligence Center (NMIC) and other designated CONUS and OCONUS locations in support of program requirements.

Required Qualifications

• Bachelor's degree in Computer Science, Information Technology, Information Assurance, or a related discipline with 8+ years of relevant experience, or a Master's degree with 6+ years of relevant experience. 15+ years of experience, including at least 10 years supporting LAN/WAN technologies, may be considered in lieu of a degree.
• Active TS/SCI security clearance.
• Active IAT Level III certification (such as CISSP).
• 8+ years of engineering experience supporting Computer Network Defense (CND).
• 6+ years of experience with Splunk, including Splunk Add-ons, Apps, Technology Add-ons (TAs), and Universal Forwarder.
• Expert knowledge of Splunk, including Splunk Enterprise, Splunk Enterprise Security, and Splunk SOAR.
• Significant experience with the System/Software Development Life Cycle (SDLC).
• Strong analytical and problem solving skills.
• Effective verbal and written communication skills.