Description

You will defend the organization against cyber threats using Splunk Enterprise Security to monitor, detect, analyze, and respond to security events.

This role is on-site.

Responsibilities

• Monitor network traffic, endpoint logs, and cloud security events for anomalous behavior and potential incidents.
• Create, maintain, and tune Splunk correlation searches, alerts, and dashboards to minimize false positives.
• Investigate security incidents, follow forensic evidence, and collaborate with IT and network teams to remediate threats.
• Develop detection and response playbooks based on threat intelligence and MITRE ATT&CK frameworks.
• Onboard new data sources with infrastructure teams, ensuring log integrity, parsing, and normalization.

Required Skills

• 8+ years of hands-on cybersecurity experience, specifically operating and investigating threats within a SIEM or Splunk.
• Proficiency in writing SPL (Splunk Processing Language).
• Strong understanding of networking, firewalls, EDR, and cloud platforms (AWS, Azure, or GCP).
• Knowledge of security frameworks (MITRE ATT&CK) and compliance standards (NIST, HIPAA, or SOC 2).
• Excellent critical thinking, problem-solving, and communication skills.
• Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related field.

Preferred Skills

• Splunk Core Certified User or Splunk Core Certified Advanced Power User certification.

Key Skills

Education

Bachelor's degree