Senior Splunk Engineer

Salary: $95,000 - 135,000 per year Requirements:

• Bachelors degree in a related field; or an associates degree plus 2+ years of relevant IT experience; or a high school diploma or GED plus 4+ years of directly related IT experience in place of a degree
• 12+ years of cybersecurity or network engineering experience, including 3+ years of Splunk engineering and content development
• Hands-on experience with Splunk Enterprise and Enterprise Security (ES) in air-gapped or mission-secure environments
• Current DoD 8140 or 8570 baseline certification at IAT Level II or higher, such as CompTIA Security+
• U.S. citizenship and an active TS/SCI clearance
• Expert-level Splunk SPL development and content creation
• Strong understanding of TCP/IP, packet structures, and network traffic analysis
• Familiarity with ExtraHop, SolarWinds, and PCAP-based threat identification
• Ability to correlate multi-source logs with behavioral and network data to create high-fidelity detections
• Experience tuning and normalizing data to align with Splunk CIM and ES frameworks
• Proficiency with regex, lookup tables, macros, and dashboard visualizations
• Strong documentation and mentoring skills
• Ability to work across cyber, networking, and threat teams to improve detection and visibility

• Lead the design and optimization of Splunk dashboards, alerts, correlation searches, and data ingestion for security and network observability
• Collaborate with network and ExtraHop teams to incorporate flow data, traffic patterns, and anomalies into actionable Splunk detections
• Develop network baseline visualizations and identify deviations using correlated log and traffic data
• Tune log sources and ingestion pipelines to improve performance, reduce false positives, and strengthen signal fidelity
• Develop and manage Splunk content for firewalls, VPNs, proxies, routers, switches, and endpoint devices
• Help analysts interpret detection triggers in the context of network flows, packet captures, and behavioral anomalies
• Configure and maintain Splunk components, including apps, indexes, forwarders, and CIM data models
• Create documentation, runbooks, and training materials for SOC teams and technical stakeholders
• Support Splunk operations in connected and disconnected environments, including secure enclave deployments
• Mentor junior engineers and analysts in SPL, dashboarding, and detection development
• Perform other duties as assigned

• Flow
• Support
• Network
• Security
• Splunk
• TCP/IP

More:

We are hiring a Splunk engineering professional to strengthen security and network observability, detection, and visibility. The role supports work in both connected and disconnected environments, including secure enclaves.

last updated 42 week of 2026