Senior Splunk Engineer

Responsibilities

Lead the design and optimization of Splunk dashboards, alerts, correlation searches, and data ingestion for security and network observability

Collaborate with network and Extra Hop teams to integrate flow data, traffic patterns, and anomalies into actionable Splunk detections

Support development of network baseline visualizations and identify deviations using correlated log and traffic data

Tune log sources and ingestion pipelines to improve performance, reduce false positives, and enhance signal fidelity

Develop and manage Splunk content related to firewalls, VPNs, proxies, routers, switches, and endpoint devices

Work with analysts to interpret detection triggers in context of network flows, packet captures, and behavior anomalies

Configure and maintain Splunk components including apps, indexes, forwarders, and CIM data models

Produce documentation, runbooks, and training for SOC teams and technical stakeholders

Operate in both connected and disconnected environments; support secure enclave deployments of Splunk

Mentor junior engineers and analysts in SPL, dashboarding, and detection development

Other duties as assigned

Qualifications

Bachelor's degree in a related field OR

Associates degree with an additional 2+ years of relevant IT experience OR

High school diploma or GED equivalent with an additional 4+ years of directly related IT experience in lieu of degree

12+ years of cybersecurity or network engineering experience with 3+ years of Splunk engineering and content development

Hands-on experience with Splunk Enterprise and Enterprise Security (ES) in air-gapped or mission-secure environments

Must hold a current DoD 8140 (or 8570) baseline certification at the IAT Level II or higher (e.g., CompTIA Security+)

U.S. Citizen with active TS/SCI clearance.

Knowledge, Skills and Abilities:

Expert-level Splunk SPL development and content creation

Strong understanding of TCP/IP, packet structures, and network traffic analysis

Familiarity with Extra Hop, SolarWinds, and PCAP-based threat identification

Ability to correlate multi-source logs with behavioral and network data to create high-fidelity detections

Experience tuning and normalizing data to align with Splunk CIM and ES frameworks

Proficiency with regex, lookup tables, macros, and dashboard visualizations

Excellent documentation and mentoring skills

Comfortable working across cyber, networking, and threat teams to improve detection and visibility