Splunk and Splunk SOAR Security Engineer

Job Responsibilities:

• Administer and maintain the Splunk Enterprise environment, including indexers, search heads, forwarders, and data onboarding.
• Configure and manage Splunk indexes, source types, data inputs, and related ingestion components.
• Monitor search head and indexer health, system performance, and overall Splunk environment availability.
• Perform Splunk performance tuning and troubleshoot infrastructure and data ingestion issues.
• Build, maintain, test, and optimize Splunk SOAR playbooks.
• Manage SOAR applications, connectors, and integrations across the security technology stack.
• Automate security response workflows using Splunk SOAR playbooks.
• Integrate Splunk and SOAR with endpoint, vulnerability management, and other security tools.
• Develop and troubleshoot REST API-based integrations.
• Diagnose and resolve API, network, authentication, data ingestion, and integration issues.
• Develop and maintain SPL searches, correlation searches, dashboards, and reports.
• Support security monitoring and system health use cases within Splunk.
• Collaborate with security engineering teams to align Splunk/SOAR capabilities with detection and incident response priorities.
• Support security operations workflows including alert triage, incident response, and threat detection engineering.
• Support Splunk and SOAR upgrades, patching, maintenance, and operational changes.
• Assist with infrastructure and security service delivery workflows.
• Develop and maintain technical documentation covering Splunk/SOAR architecture, configurations, integrations, and playbooks.
• Create and maintain standard operating procedures to support consistent operations and knowledge transfer.
• Support custom SOAR application development and automation using scripting where required.
• Identify opportunities to improve security automation, detection, response, and operational efficiency.
• Work closely with cross-functional security and technology teams to resolve technical issues and deliver security solutions.

Skills:

• Splunk Enterprise Administration
• Splunk SOAR
• Splunk Indexers
• Splunk Search Heads
• Splunk Forwarders
• Splunk Data Onboarding
• Index and Source Type Management
• Splunk Performance Tuning
• SPL (Search Processing Language)
• Correlation Searches
• Dashboard and Report Development
• Splunk System Health Monitoring
• Splunk SOAR Playbook Development
• SOAR Automation
• Security Tool Integrations
• REST APIs
• API Integration
• Endpoint Security Integration
• Vulnerability Management Integration
• Network Troubleshooting
• Authentication Troubleshooting
• Python
• PowerShell
• Security Operations
• Incident Response
• Threat Detection Engineering
• Alert Triage
• Security Engineering
• Infrastructure Build Pipelines
• Technical Documentation
• SOP Development

Education/Experience:

• 3+ years of hands-on experience administering Splunk Enterprise.
• Strong experience with Splunk indexers, search heads, forwarders, and data onboarding.
• Direct experience building and maintaining Splunk SOAR playbooks.
• Direct experience integrating Splunk/SOAR with endpoint, vulnerability, or other security tools.
• Experience developing and troubleshooting REST API-based integrations.
• Strong troubleshooting skills involving APIs, networks, authentication, and security-tool integrations.
• Strong SPL skills, including correlation searches, dashboard/report development, and system health monitoring.
• Splunk certifications such as Core Certified Power User, Certified Admin, or SOAR certifications are preferred.
• Python or PowerShell scripting experience for SOAR automation or custom application development preferred.
• Familiarity with security operations workflows, including alert triage, incident response, threat detection engineering, and infrastructure build pipelines.
• Bachelor's degree in Cybersecurity, Computer Science, Management Information Systems (MIS), or a related discipline preferred.
• Equivalent combination of education and professional experience may be considered.
• Ability to work in a hybrid environment with 2 days onsite per week in Taylor, TX.