Principal Splunk-Threat Detection & Integration Engineer (Cybersecurity)

TL;DR

Principal Splunk-Threat Detection & Integration Engineer (Cybersecurity): Own the detection content lifecycle in Splunk Enterprise Security with an accent on complex correlation searches, Risk-Based Alerting logic, and custom integrations across security stack. Focus on architecting RBA programs, building cross-domain detections mapped to MITRE ATT&CK, and operationalizing threat intelligence frameworks.

Location: Remote (USA - Must Work EST 8:30AM-5:30PM, U.S. Citizen required)

Company

Cybersecurity firm focused on Splunk Enterprise Security solutions for threat detection and response.

What you will do

• Own detection content lifecycle: design, SPL prototyping, validation, peer review, deployment, tuning, and decommissioning.
• Architect Risk-Based Alerting program including risk signals, notables, scoring, modifiers, and throttling strategies.
• Write and optimize complex SPL using accelerated data models, lookups, KV-store, and REST introspection.
• Engineer Splunk CIM normalization, Asset & Identity framework, and Threat Intelligence operationalization with IOC feeds and CVE integration.
• Develop custom integrations and automation via REST APIs, HEC, Python connectors, and SOAR playbooks.
• Build cross-domain detections across identity, endpoint, network, cloud, and more; onboard log sources; manage license capacity; create SOC dashboards.

Requirements

• 8+ years in security engineering/SOC/IR/detection content, 5+ years Splunk ES in production
• Mastery of SPL, performance search design, multi-value handling, lookups, KV-store, REST API.
• Full Splunk ES experience: correlation searches, findings, Risk Framework, Asset & Identity, Threat Intelligence.
• Senior RBA practice: risk rules, scoring calibration across domains, aggregate strategies.
• Splunk CIM fluency, custom mappings, base searches; hands-on detection across all security domains with MITRE mapping.
• Log onboarding, custom integrations/automation (REST/HEC/Python/SOAR), threat intel operationalization; Splunk certification required.

Culture & Benefits

• Senior individual-contributor role driving programs and mentoring juniors.
• Operate against tight deadlines across concurrent workstreams as technical authority and escalation point.
• Peer review and documentation standards for every detection.