Splunk / SOC Engineer - 174235 - 174717 - 175230

Zachary Piper Solutions; North Carolina; Hybrid; USD 100,000 - 120,000; Full time

Job summary

Piper Companies is seeking a skilled Splunk Engineer / SOC Engineer to support development and optimization of enterprise security monitoring and analytics. This full-time role is hybrid, with 2 days on-site per week, and requires a Secret clearance.

You will work closely with SOC analysts, cloud teams, and engineering stakeholders to enhance detection capabilities, visibility, and operational efficiency through Splunk engineering and automation.

Qualifications

• 5+ years in SIEM engineering, security operations, or incident response environments.
• Strong proficiency with Splunk, including writing complex SPL queries and building production-grade dashboards.
• Hands-on experience with data normalization, ingestion, and troubleshooting within Splunk Enterprise or Splunk ES.
• Experience integrating and onboarding security data sources into a centralized SIEM platform.
• Familiarity with integrating tools such as AWS Security Hub or similar cloud-native security services.
• Strong CIM knowledge objects, field extractions, and CIM normalization.
• Ability to perform effectively in high-pressure incident response situations and a willingness to participate in on-call rotations.

Responsibilities

• Developing, maintaining, and optimizing Splunk detections, dashboards, and correlation searches.
• Onboarding, parsing, normalizing, and enriching security data sources into Splunk.
• Troubleshooting ingestion pipelines, forwarder connectivity, indexing issues, and search performance challenges.
• Assisting with configuration, maintenance, and troubleshooting across distributed Splunk environments.
• Leveraging data models and accelerated searches to improve detection and reporting.
• Collaborating with SOC analysts and engineering teams to enhance threat detection and response workflows.
• Participating in incident response activities, including deep-dive investigations into security alerts.

Skills

Splunk

SPL queries

SIEM

Data normalization

Dashboards

Incident response

On-call readiness

Tools

Splunk Enterprise

Splunk ES

Splunk SOAR

AWS Security Hub

Job description

Piper Companies is seeking a highly skilled Splunk Engineer / SOC Engineer to support the development and optimization of enterprise security monitoring and analytics within a fast-paced environment. This role plays a critical part in enhancing detection capabilities, improving security visibility, and driving operational efficiency through Splunk engineering and automation. This is a full-time opportunity working closely with SOC analysts, cloud teams, and engineering stakeholders hybrid 2 days a week onsite. This position requires a Secret clearance in order to be eligible.

Responsibilities for the Splunk Engineer include:

• Developing, maintaining, and optimizing Splunk Security detections, dashboards, and correlation searches.
• Onboarding, parsing, normalizing, and enriching diverse security data sources into Splunk.
• Troubleshooting ingestion pipelines, forwarder connectivity, indexing issues, and search performance challenges.
• Assisting with configuration, maintenance, and troubleshooting across distributed Splunk environments.
• Leveraging data models and accelerated searches to improve detection performance and reporting efficiency.
• Collaborating with SOC analysts and engineering teams to enhance threat detection, visibility, and response workflows.
• Participating in incident response activities, including deep-dive investigations into security alerts.

Qualifications for the Splunk Engineer include:

• Minimum of 5+ years of experience in SIEM engineering, security operations, or incident response environments.
• Strong proficiency with Splunk, including writing complex SPL queries and building production-grade dashboards.
• Hands-on experience with data normalization, ingestion, and troubleshooting within Splunk Enterprise or Splunk ES.
• Experience integrating and onboarding security data sources into a centralized SIEM platform.
• Familiarity with integrating tools such as AWS Security Hub or similar cloud-native security services.
• Strong understanding of Splunk knowledge objects, field extractions, lookups, and CIM normalization.
• Ability to perform effectively in high-pressure incident response situations and a willingness to participate in on-call rotations.

Compensation for the Splunk Engineer includes:

• Salary range: $100,000 - $120,000
• Comprehensive benefits package including Medical, Dental, Vision, 401k, PTO, holidays, and sick leave as required by law.

Keywords: Splunk Enterprise, Splunk Enterprise Security (ES), Splunk SOAR, SIEM Engineering, Security Information and Event Management, SIEM, SPL, Search Processing Language, Correlation Searches, detection engineering, security analytics, Data ingestion, data onboarding, data normalization, CIM, log parsing, field extractions, pipeline troubleshooting, Security operations center, SOC, incident response, threat detection, alert investigation, AWS, AWS security, AWS security hub, Azure security, Entra ID, Azure AD, distributed splunk environment, forwarders

#LI-BH1

#HYBRID

This job is open for applications on 10/2/2026 and will remain open for at least 30 days from the posting date.