Sr Security Engineer with SPLUNK/SIEM

CTC Group, Inc; Harrisburg (Dauphin County); Hybrid; USD 90,000 - 130,000; Full time

Job summary

CTC Group, Inc is seeking a SIEM Security Engineer to support the Splunk-based enterprise SIEM environment. You will assist in design, configuration, integration, and daily operations to strengthen security monitoring, threat detection, incident response, and log management.

Reporting to the Director of Security, you will work in a hybrid role at our Harrisburg location, contribute to data onboarding, content development, and incident response activities, and ensure governance and documentation

Qualifications

• Experience: 3+ years in SIEM, security engineering, SOC operations, or security monitoring technologies.
• Splunk Administration: 3+ years administering Splunk Enterprise and/or Splunk Enterprise Security.
• Log ingestion: 3+ years onboarding/integrating log sources via syslog, APIs, forwarders/agents, or cloud integrations.

Responsibilities

• Engineer, configure, and maintain the enterprise SIEM platform (Splunk) and related tools.
• Onboard data sources; parse, index, and manage retention for logs.
• Develop and maintain correlation searches, dashboards, and alerts.

Skills

SIEM

Splunk

SOC operations

Log ingestion

Threat detection

Tools

Splunk Enterprise

Forwarders/Agents

APIs

Cloud integrations

Job description

Location: Harrisburg, PA 17120 (Hybrid - 3 days/week onsite, Keystone Building, 5th Floor)

Interview Format: In-Person

Reporting To: Director of Security

Position Overview

We are seeking a SIEM Security Engineer to provide specialized hands-on technical support for our Enterprise Security Information and Event Management (SIEM) environment. You will support the design, configuration, integration, optimization, and daily operations of the SIEM platform (Splunk) to strengthen enterprise security monitoring, threat detection, incident response, and log management.

Note: Strategic direction, governance, and overall program oversight remain under the leadership of the Director.

Key Responsibilities

• Platform Engineering & Maintenance: Engineer, configure, maintain, and optimize the enterprise SIEM platform (Splunk and related security tools). Execute upgrades, patches, testing, and system changes while maintaining platform health, capacity, and availability.
• Data Onboarding & Log Management: Onboard new data sources. Parse, normalize, index, and manage retention for incoming logs using syslog, APIs, agents, and cloud integrations.
• Detection & Content Development: Build and maintain correlation searches, custom alerts, dashboards, reports, detection rules, and security monitoring content.
• Alert Tuning & Troubleshooting: Fine-tune detection logic and alerts to minimize false positives. Resolve complex SIEM, data ingestion, and integration issues.
• System & Tool Integration: Integrate SIEM capabilities with security infrastructure, cloud platforms, networks, and enterprise applications.
• SOC & Incident Response Support: Provide technical expertise, custom SPL queries, dashboards, and investigative support to SOC analysts and incident response teams.
• Governance & Documentation: Maintain system configurations, operational procedures, and technical documentation. Follow change-management workflows, security standards, and policy compliance guidelines.

Qualifications & Requirements

Required Qualifications

• Experience: Minimum 3 years of professional IT experience in SIEM, security engineering, SOC operations, or security monitoring technologies.
• Splunk Administration: Minimum 3 years administering or engineering Splunk Enterprise and/or Splunk Enterprise Security.
• Log Ingestion: Minimum 3 years onboarding and integrating log sources via syslog, APIs, forwarders/agents, or cloud-native integrations.

Highly Desired Qualifications

• Experience engineering SIEM solutions within large enterprise or government environments.
• Strong proficiency in developing complex Search Processing Language (SPL) queries, dashboards, alerts, and correlation searches.
• Hands-on experience troubleshooting complex logging pipelines and data ingestion failures.
• Familiarity with industry cybersecurity frameworks (NIST CSF, MITRE ATT&CK).