SIEM Subject Matter Expert (Splunk)
Accenturefederalservices · Washington, DC
About this role
**SIEM Subject Matter Expert (Splunk)** **Who you’ll be** The Splunk Enterprise Security Subject Matter Expert will manage and optimize a large-scale Splunk deployment, ensuring effective architecture and platform health for substantial log ingestion across numerous endpoints. This role enhances Security Operations Center (SOC) throughput through expert knowledge of Splunk and its integrations. **What you’ll do** - Own Splunk Enterprise Security architecture, sizing, and platform health management. - Develop and tune correlation rules and use cases mapped to the MITRE ATT&CK framework. - Onboard new log sources and normalize data across a large, diverse endpoint environment. - Build and maintain SIEM-to-SOAR integrations that drive automated alert enrichment and response. - Produce Splunk platform performance reporting and capacity-planning recommendations. - Support platform upgrades, patching, and lifecycle management. - Train and mentor SOC analysts on Splunk use and best practices. - Troubleshoot platform performance and data-quality issues. **What you’ll need** - 5 years of SIEM architecture/engineering experience, including experience with large-scale deployments ingesting significant daily data volumes. - Bachelor’s degree in Computer Science, Information Technology, or related field (equivalent experience considered in lieu of a degree). - Deep knowledge of Splunk architecture, Search Processing Language (SPL), and data onboarding. - Experience integrating SIEM with SOAR platforms for automated response. **Required Certifications** - Splunk Certified Architect (Splunk Enterprise Security Certified Admin also considered). **Compensation (where applicable)** - Base pay range: **$109,500 — $224,200 USD** (states include CA, CO, CT, HI, IL, ME, MD, MA, MN, NJ, NY, OH, VT, VA, WA, and DC).
Listing freshness
CronJobs last confirmed this listing 2h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.