[Remote] Senior Splunk Security Engineer

Note: The job is a remote job and is open to candidates in USA. HonorVet Technologies is a Service Disabled Veteran-Owned IT staffing firm serving federal agencies, state governments, and Fortune 500 enterprise clients across the United States. The Senior Splunk Security Engineer will design, implement, test, and document privileged access event monitoring within a security operations environment. The role focuses on Splunk SIEM correlation searches, risk-based alerting, SOAR automation, alert enrichment, dashboards, documentation, and knowledge transfer.

Responsibilities

• Design and implement privilege access event monitoring logic to identify security-relevant privileged access activity
• Develop intelligent alert routing and correlation logic to distinguish true security threats from routine operational events
• Build and optimize Splunk correlation searches, custom alert rules, and risk-based alerting logic
• Configure filtering, suppression, and enrichment rules to reduce alert noise and improve alert quality
• Design and develop SOAR workflows and playbooks to automate incident handling and alert consolidation
• Integrate SIEM, SOAR, and ticketing processes to support consistent incident routing and management
• Create enrichment logic that adds relevant context to alerts, including user, asset, access, and threat-level information
• Build dashboards and reports to monitor alert health, performance, volume, and operational effectiveness
• Test the implementation against historical datasets of at least 60 days to validate alert accuracy and volume reduction
• Document all implemented searches, workflows, logic, playbooks, dashboards, edge cases, and operating procedures
• Create runbooks and operational guides for ongoing support and maintenance
• Provide knowledge transfer and training to security operations and engineering teams prior to engagement completion

Skills

• 4-5 years Splunk experience
• 4-5 years IAM experience
• Minimum of 5 years of experience in security operations, SIEM engineering, security engineering, or a related cybersecurity function
• At least 3 years of hands-on Splunk experience in production environments
• Advanced proficiency developing Splunk correlation searches, custom alert rules, dashboards, and reports
• Experience configuring and implementing Splunk Risk-Based Alerting for security use cases
• Strong understanding of Splunk data pipelines, search performance optimization, indexing, field extraction, and alert tuning
• At least 2 years of hands-on experience with SOAR platforms such as Cortex XSOAR, Demisto, or comparable orchestration platforms
• Experience designing and implementing complex SOAR playbooks, workflows, automation logic, and incident handling processes
• Experience integrating SOAR platforms with SIEM tools, ticketing systems, and other security operations technologies
• At least 2 years of experience with privilege access monitoring, identity and access management security, privileged access management, or related security operations use cases
• Understanding of privilege escalation detection methodologies, authorization frameworks, access control models, and IAM-related security monitoring
• Proven experience reducing false positives and improving alert fidelity in high-volume security
• Monitoring-preferred (previous analyst work)

Benefits

• Remote work arrangement
• 6-month engagement with possible extension
• Knowledge transfer and training for security operations and engineering teams

Company Overview

Company H1B Sponsorship