Incident Response Analyst - Agentic SOC

The application window is expected to close on: 11/05/2026

This position will perform work that the U.S. government has specified can only be performed by a U.S. citizen on U.S. soil

Meet the Team Splunk Global Security is Customer Zero for Splunk’s security products: our 24/7 global SOC runs Splunk’s newest AI agents against real production threats before most of the world sees those agents, and turns what we learn into product changes that reach Splunk’s customers. We are now making agent-assisted investigation the way our SOC works every day, with AI agents handling repetitive triage, enrichment, and summarization so analysts can focus on judgment calls and deeper investigation.

You will join the team defining how analysts and agents work together in a production SOC, setting the patterns other teams adopt. Splunk, a Cisco company, is building a safer and more resilient digital world, and offers a high-performance environment where people at every level are empowered to make an impact and advance their careers!

Your Impact Split your time between investigating incidents in our global 24/7 SOC and building, evaluating, and hardening the agentic tooling behind those investigations, helping decide how far agents can act on their own, when a human must approve, and how we prove the agents got it right. Triage, investigate, and respond to alerts across Splunk’s product and enterprise environments, using agentic triage and enrichment as a first pass and validating every verdict before acting, then scope incidents with Splunk Enterprise Security (Mission Control), SPL, and EDR, identity, and cloud tooling to collect evidence, document findings, and drive containment and critical issue.

Partner with Detection Engineering to tune detections, reduce false positives, and close coverage or data-quality gaps surfaced by analysts or agents. Build and maintain agent skills, prompts, and integrations (MCP servers, SOAR playbooks, enrichment lookups) through Git Lab merge requests and code review, turning every recurring manual procedure into a tested, documented agent workflow and keeping runbooks current, so you and your peers spend less time on toil and more on deeper investigation and real incident response.

Evaluate and harden that tooling with test cases from real alerts, accuracy and false-verdict tracking, approval gates, autonomy limits, audit trails, and defenses against prompt injection, sensitive-data exposure, and over-privileged credentials, while running pre-release Splunk security AI as Customer Zero and delivering structured findings to the Enterprise Security, SOAR, and AI product teams, so what you learn becomes product changes for Splunk’s customers.

Minimum Qualifications 4+ years of experience in security operations, incident response, or security monitoring, including alert triage and investigation with SIEM, EDR, identity, and cloud tooling, plus knowledge of incident response process and common attacker techniques.

Experience with TCP/IP, DNS, HTTP, authentication flows, endpoint behavior, and cloud

Experience writing and troubleshooting security searches in SPL, KQL, SQL, or a similar query language.

Experience reading and modifying Python or Bash automation, YAML/JSON configuration, and playbooks using Git workflows (branches, merge requests, code review).Experience using LLM-based or agentic tools, verifying their output against raw evidence.

Preferred Qualifications

Experience with Splunk Enterprise Security 8 (Mission Control), Splunk SOAR, or Splunk AI Assistant.

Experience building agent tools or integrations: LLM tool calling, Model Context Protocol (MCP) servers, or retrieval-augmented generation (RAG) over runbooks and case history.

Experience designing evaluations for…