TS/SCI Splunk SOAR Engineer - Automate Incident Response

GDIT; Los Angeles (CA); On-site; USD 128,000 - 173,000; Full time

Job summary

GDIT is seeking a Cybersecurity Splunk SOAR Engineer to advance incident response through automation. The role requires deep expertise in Splunk SOAR, scripting in Python, and integration with Splunk ES and other security tools.

You will drive content development, playbooks, and scalable orchestration across enterprise environments. You will collaborate with SOC teams to translate security procedures into automated workflows, improve MTTR, and deliver architecture that supports DoD networks.

Qualifications

• 8+ years of related experience.
• Certification: DoD 8140/8570.
• TS/SCI clearance required.
• US citizenship required.
• Proven hands-on Splunk SOAR (Phantom) administration and content development.
• Experience integrating SOAR with security tools and ES.

Responsibilities

• Design, deploy, and document distributed Splunk SOAR platform architecture.

Skills

Splunk SOAR

Security operations

Python scripting

Incident response

SOAR content development

RESTful APIs

Tools

Splunk Phantom

Splunk ES

Python

APIs

Security tools

Job description

GDIT is seeking a Cybersecurity Splunk SOAR Engineer to advance incident response through automation. The role requires deep expertise in Splunk SOAR, scripting in Python, and integration with Splunk ES and other security tools.

You will drive content development, playbooks, and scalable orchestration across enterprise environments. You will collaborate with SOC teams to translate security procedures into automated workflows, improve MTTR, and deliver architecture that supports DoD networks.