Cybersecurity Specialist Splunk Engineer

SAIC is a mission integrator delivering secure technology and professional services across defense, space, intelligence, and civilian markets. The Cybersecurity Specialist, Splunk Engineer will administer and engineer Splunk and other SIEM tools, develop detections and dashboards, manage data sources and integrations, and support Enterprise Security Operations through incident resolution, documentation, automation, and stakeholder collaboration.

Responsibilities:

• Administer, install, configure, and maintain Splunk (cloud and on prem) and other SIEM/log management tools
• Develop, audit, and optimize correlation rules; collaborate with ESOC to create new detections
• Build and maintain dashboards, reports, alerts, and visualizations
• Create and optimize SPL queries; manage knowledge objects (field extractions, tags, lookups, macros)
• Onboard and manage data sources (syslog, HEC, forwarders, APIs)
• Manage deployment servers and forwarders
• Maintain inputs, reporting, and alerting across Azure and AWS environments
• Work at the system level to improve performance and propose platform enhancements
• Develop scripts and integrations with security tools (Python, Bash, PowerShell)
• Work with workflow automation tools to orchestrate processes with ServiceNow and other security/infrastructure platforms
• Use regular expressions (regex) for parsing, extraction, and automation
• Document procedures for data ingestion and maintain access controls for compliance
• Create and implement configuration standards, policies, and procedures for improved operations
• Develop program metrics to measure monitoring effectiveness
• Resolve incidents and issues; integrate changes with established change management processes
• Train and mentor ESOC members on SIEM capabilities and best practices
• Interface with analysts and business stakeholders to ensure tools, dashboards, and applications meet requirements
• Communicate effectively with teams and clients
• Work across Linux and Windows platforms
• Apply an understanding of networking technologies, workflows, and IT reporting

Requirements:

• Bachelor's Degree and 5+ years cybersecurity operation related experience or software analyst/programming related experience, or master's degree and 3+ years related experience. An additional 4 years of experience may be considered in lieu of a degree
• Demonstrated experience administering and engineering Splunk
• Must be a US Citizen