SIEM Subject Matter Expert (Splunk)

Who you'll be:

The Splunk Enterprise Security Subject Matter Expert will manage and optimize a large-scale Splunk deployment, ensuring effective architecture and platform health for substantial log ingestion across numerous endpoints. This role is crucial for enhancing Security Operations Center (SOC) throughput through expert knowledge of Splunk and its integrations.

What you'll do:

• Own Splunk Enterprise Security architecture, sizing, and platform health management.
• Develop and tune correlation rules and use cases mapped to the MITRE ATT&CK framework.
• Onboard new log sources and normalize data across a large, diverse endpoint environment.
• Build and maintain SIEM-to-SOAR integrations that drive automated alert enrichment and response.
• Produce Splunk platform performance reporting and capacity-planning recommendations.
• Support platform upgrades, patching, and lifecycle management.
• Train and mentor SOC analysts on Splunk use and best practices.
• Troubleshoot platform performance and data-quality issues.

What you'll need:

• 5 years of SIEM architecture/engineering experience, including experience with large-scale deployments ingesting significant daily data volumes.
• Bachelor's degree in Computer Science, Information Technology, or related field (equivalent experience considered in lieu of a degree).
• Deep knowledge of Splunk architecture, Search Processing Language (SPL), and data onboarding.
• Experience integrating SIEM with SOAR platforms for automated response.

Required Certifications:

• Splunk Certified Architect (Splunk Enterprise Security Certified Admin also considered).