Cybersecurity Engineer 3

BranCore Technologies is hiring a Cybersecurity Engineer 3 to support a Splunk SIEM program focused on monitoring, detection, analysis, and response to security events. This fully onsite contract role is based in the Richmond, VA area, where you will help improve detection quality, ensure SIEM data integration, and support compliance reporting.

What you’ll do

• Continuously monitor network traffic, endpoint logs, and cloud security events to identify anomalous behavior and potential security incidents.
• Create, maintain, and tune Splunk correlation searches, alerts, and dashboards to reduce false positives and strengthen detection coverage.
• Investigate potential security incidents, preserve and follow forensic evidence, and coordinate with IT and network teams to remediate threats.
• Develop and refine detection and response playbooks using threat intelligence and frameworks such as MITRE ATT&CK .
• Partner with infrastructure teams to onboard new data sources, ensuring log integrity, parsing, and normalization across the SIEM platform.
• Support audit readiness by collecting SIEM control evidence and generating compliance reports aligned to internal policies and standards.

Required experience and skills

• Minimum 8+ years of hands-on cybersecurity experience, specifically operating, building, and investigating threats within a SIEM or Splunk. Required
• Strong critical thinking, problem-solving, and communication skills, with the ability to operate calmly under pressure and manage multiple security tickets. Required
• Proficiency writing SPL (Splunk Processing Language) . Required
• Solid understanding of networking, firewalls, EDR, and cloud platforms including AWS , Azure , or GCP . Required
• Knowledge of security frameworks (for example, MITRE ATT&CK ) and security compliance standards such as NIST , HIPAA , or SOC 2 . Required
• Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related field. Required
• Relevant certifications such as Splunk Core Certified User and Splunk Core Certified Advanced Power User are highly preferred. Highly desired

Technologies

• Splunk Enterprise Security, Splunk, Splunk SIEM
• SPL (Splunk Processing Language)
• MITRE ATT&CK
• AWS, Azure, GCP
• NIST, HIPAA, SOC 2
• EDR

Location and contract details

• Location: Richmond, VA (onsite)
• Work setup: Fully onsite
• Contract length: 8 months, with the possibility of extending based on project need
• Requirement: Candidate must reside in the Richmond, VA area