Senior Splunk Detection Engineer

Job Summary

To enhance the effectiveness of the National Science Foundation's Cybersecurity & Privacy Program, the full-time Senior Splunk Detection Engineer will design, build, and improve detection content in Splunk Enterprise Security, focusing on high-fidelity detections, Risk-Based Alerting, and incident response collaboration while working remotely.

Key responsibilities

• Design, build, test, and continuously improve Splunk Enterprise Security detection content
• Implement and optimize Risk-Based Alerting (RBA) strategies and improve detection quality
• Collaborate with Incident Response teams to enhance detection capabilities based on real-world incidents

Required qualifications

• Active Public Trust clearance or the ability to obtain one
• Minimum seven (7) years of cybersecurity experience, including four (4) years in Detection Engineering or Security Operations
• Experience building and tuning Splunk Enterprise Security correlation searches
• Strong AWS security knowledge, including GuardDuty, CloudTrail, and Security Hub
• Proficiency with SPL, Python, REST APIs, and Git