Senior Splunk Engineer

Salary: $150,000 - 150,000 per year Requirements: We are looking for hands-on experience designing, implementing, and tuning Splunk Enterprise and Splunk Enterprise Security environments. We need strong knowledge of distributed Splunk architectures, including indexers, search heads, heavy forwarders, deployment servers, and clustered setups. Experience building and maintaining data onboarding pipelines for security, infrastructure, cloud, and application logs is required. You should have expertise in performance optimization, data retention planning, indexing strategy, and search efficiency. We expect experience implementing and administering Splunk UEBA or legacy UBA platforms. You should be able to develop behavioral models and anomaly detection use cases for insider threat, account compromise, privilege misuse, and lateral movement. Experience tuning anomaly scoring models to lower false positives and improve detection quality is needed. You should be able to integrate identity, authentication, endpoint, cloud, and network telemetry into UEBA models. We are looking for experience developing correlation searches, risk-based alerting content, and custom detections in Splunk Enterprise Security. Knowledge of Security Content Framework use cases aligned with MITRE ATT&CK is required. Strong SPL skills are needed, including custom queries, macros, lookups, data models, and accelerated searches. Experience supporting threat hunting and incident response investigations is expected. DoD 8570 certification is preferred. Top Secret clearance is required. This role is based in a hybrid remote arrangement in Suitland, Maryland. Responsibilities: We design, deploy, configure, and maintain Splunk Enterprise and Splunk Enterprise Security environments. We administer distributed Splunk architectures, including indexers, search heads, heavy forwarders, deployment servers, and cluster configurations. We build and maintain data onboarding pipelines for security, infrastructure, cloud, and application logs. We improve Splunk performance, indexing, search speed, and data retention approaches. We create dashboards, reports, visualizations, and executive-level security metrics. We implement, configure, and maintain Splunk UEBA or legacy UBA environments. We develop behavioral models and anomaly detection use cases to identify insider threat, account compromise, privilege misuse, and lateral movement. We tune anomaly scoring models to reduce false positives and strengthen detection accuracy. We integrate identity, authentication, endpoint, cloud, and network telemetry into UEBA models. We work with SOC analysts and threat hunters to validate and improve behavioral detections. We develop and maintain correlation searches, risk-based alerting content, and custom detections in Splunk Enterprise Security. We create and optimize Security Content Framework use cases aligned with MITRE ATT&CK. We build custom SPL queries, macros, lookups, data models, and accelerated searches. We implement risk-based monitoring and expand detection coverage across enterprise environments. We support threat hunting and incident response investigations. Technologies: Cloud Support Network Security Splunk DevOps More: We are seeking a highly skilled Splunk Engineer with a UEBA/UBA focus to help build scalable security monitoring capabilities, develop advanced detection content, integrate diverse data sources, and strengthen threat detection through behavioral analytics. The ideal candidate will bring deep expertise in Splunk architecture, security operations, threat detection engineering, and behavioral analytics to support enterprise cybersecurity initiatives. This is a hybrid remote role based in Suitland, Maryland, with a salary starting from $150,000 per year. last updated 39 week of 2026