Splunk Detection Engineer

About the role

The Splunk Detection Engineer will support a cybersecurity services company by ensuring security logs are correctly formatted, ingested, and leveraged to detect potential threats. This is a full‑time, 1‑year contract position performed primarily remotely.

Key responsibilities

• Integrate new data sources such as databases, APIs, and files, establishing standards and coordinating with IT administrators.
• Validate and configure CIM‑compliant logs.
• Process analyst requests for new detections within Splunk Enterprise Security.
• Analyze existing logs to identify formatting issues and gaps for new detections.
• Add and maintain threat feeds in Splunk Enterprise Security.
• Monitor and tune detection performance.
• Manage asset and identity inventory within Splunk Enterprise Security.
• Create and maintain custom Splunk apps.
• Recommend changes to Splunk data models to meet detection needs.
• Develop searches, reports, dashboards, and other functionalities for cyber use‑cases.
• Assist users with search optimization and mentor peers.
• Participate in virtual meetings and provide status updates.

Required profile

• U.S. citizenship (W‑2 employment only).
• Ability to work remotely with occasional on‑site meetings if within driving distance of the lab.
• Experience in cybersecurity log collection, analysis, and event detection.

Required skills

• Splunk Enterprise Security
• Splunk Common Information Model (CIM)
• Data source integration (APIs, databases, files)
• Threat feed integration and management
• Search development and dashboard creation in Splunk
• Log formatting and validation