TS/SCI Splunk Engineer

Job Description The Splunk Engineer will serve as a technical expert responsible for the design, administration, and optimization of the enterprise Splunk environment, with a specialized and heavy focus on User and Entity Behavior Analytics (UEBA). The engineer will bridge the gap between core log management and advanced behavioral analytics by leveraging Splunk User Behavior Analytics (UBA) and machine learning models to detect compromised accounts, insider threats, and lateral movement. This position ensures that high-fidelity behavioral telemetry is integrated, baselined, and actionable for the Security Operations Center (SOC). Responsibilities Lead the design, engineering and deployment of Splunk User Behavior Analytics (UBA), focusing on the ingestion of identity-centric data sources (e.g., Active Directory, VPN, Cloud Access Security Brokers, and HR systems). Develop, tune, and optimize machine learning models and behavioral algorithms to establish accurate baselines for "normal" user and entity behavior. Collaborate with the Insider Threat and SOC teams to identify anomalous activity, such as credential misuse, unusual data movement, and account takeover (ATO) scenarios. Perform advanced data normalization and tagging using the Splunk Common Information Model (CIM) to ensure behavioral data is properly structured for the UEBA engine. Integrate UEBA-generated anomalies and threats into the Splunk Enterprise Security Incident Review dashboard and Security Orchestration, Automation, and Response (SOAR) playbooks. Monitor UEBA system health, including data ingestion rates, model processing times, and platform stability, performing rapid troubleshooting as required. Document technical configurations, threat modeling logic, and behavioral detection playbooks for the engineering and analyst teams. Skills and Requirements Min 12 years with HS degree, 10 years with AS/AA degree, 8 years with BS/BA, 6 years with MS/MA, 3 years with PhD DoD 8570 IAT II Certification DoD TS/SCI clearance UEBA Experience including data ingestion rates, model processing times, and platform stability, performing rapid troubleshooting as required. Experience integrating UEBA-generated anomalies and threats into the Splunk Enterprise Security Incident Review dashboard and Security Orchestration, Automation, and Response (SOAR) playbooks. Experience creating the design, engineering and deployment of Splunk User Behavior Analytics (UBA), focusing on the ingestion of identity-centric data sources (e.g., Active Directory, VPN, Cloud Access Security Brokers, and HR systems). Experience developing, tuning, and optimizing machine learning models and behavioral algorithms to establish accurate baselines for "normal" user and entity behavior. Experience performing advanced data normalization and tagging using the Splunk Common Information Model (CIM) to ensure behavioral data is properly structured for the UEBA engine. Experience documenting technical configurations, threat modeling logic, and behavioral detection playbooks for the engineering and analyst teams. Experience using Python or Bash for automation of Splunk administrative tasks and API integrations. Knowledge of the MITRE ATT&CK framework and mapping behavioral anomalies to specific adversary tactics and techniques. Must be with DoW 8140 compliant under the Work Role Code 451 – Systems Administrator Intermediate - Intermediate level or higher by 1 Oct 26. Previous experience operating within Department of War (DoW) or DoD enterprise network environments. Active Splunk Enterprise Security Certified Admin or Splunk Certified Developer certifications. We are a company committed to creating diverse and inclusive environments where people can bring their full, authentic selves to work every day. We are an equal opportunity/affirmative action employer that believes everyone matters. Qualified candidates will receive consideration for employment regardless of their race, color, ethnicity, religion, sex (including pregnancy), sexual orientation, gender identity and expression, marital status, national origin, ancestry, genetic factors, age, disability, protected veteran status, military or uniformed service member status, or any other status or characteristic protected by applicable laws, regulations, and ordinances. If you need assistance and/or a reasonable accommodation due to a disability during the application or recruiting process, please send a request to View email address on click.appcast.io learn more about how we collect, keep, and process your private information, please review Insight Global's Workforce Privacy Policy: #J-18808-Ljbffr Insight Global