Splunk Security & Detection Engineer

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

3 days ago Requisition

Salary Range: $ To $ Annually

Splunk Security & Detection Engineer

Department: Network Operations & Security Center

Reports To: CTO

Employment Type: Full-Time

Net
56 is seeking a skilled Splunk Engineer to join our Network Operations and Security Center team. This role is responsible for the design, deployment, operational maintenance, and optimization of our distributed Splunk environment across on-premises, cloud, and client infrastructures.

The Splunk Engineer will bridge platform engineering and security operations by onboarding diverse data sources (firewalls, switches, endpoints, cloud services), architecting custom dashboards and correlation searches and automating threat detection and incident triage workflows.

• Build, deploy, administer, and maintain a distributed Splunk architecture (Splunk Enterprise SEIM/Enterprise Security /SOAR) across Windows and Linux environments.
• Manage, configure, and maintain multi-site indexer clusters, data routing, parsing, and event normalization per the Splunk Common Information Model (CIM).
• Onboard diverse log sources via Universal Forwarders, scripted inputs, Syslog/TCP/UDP, modular inputs, REST APIs, and Splunk DB Connect.
• Edit and maintain Splunk configuration and custom applications.
• Monitor cluster health, resource utilization, indexing rates, and search performance to optimize license efficiency and search runtimes.

• Develop, tune, and maintain custom Splunk correlation searches, alerts, and investigative dashboards to enhance real-time visibility and threat detection accuracy.
• Map detections to industry standards (MITRE ATT&CK, NIST 800-53, CIS Controls) to continuously lower false-positive rates and prevent alert fatigue.
• Integrate Splunk with network network infrastructure devices, identity providers, and cloud environments.
• Create regular expressions (regex) and automated scripts (Python, Bash, Power Shell) to accelerate log parsing, IOC extraction, and administrative tasks.

• Act as an escalation engineer for complex event monitoring, log gap analysis, and incident investigations.
• Collaborate with Network Infrastructure Engineers, Systems Administrators, and client-facing teams to configure and validate new data feeds.
• Produce and maintain comprehensive technical documentation, network topology/data flow diagrams, SOPs, and runbooks.
• Deep proficiency with Splunk CLI, configuration file architecture, and data parsing pipelines.
• Strong knowledge of enterprise networking fundamentals: TCP/IP, UDP, routing/switching, VLANs, firewalls, and NAT.
• Solid administration background in both Linux (RHEL) and Windows Server operating systems.
• Hands-on scripting capability in Python, Bash, or Power Shell for API data inputs and automation.
• Experience aligning detections with security frameworks (NIST, CIS, MITRE ATT&CK).

• Must currently reside within a 30-minute driving distance of Deer Park, IL.
• Education:
  
  Bachelor’s Degree in Information Technology, Computer Science, Cybersecurity, or related field (or equivalent practical experience).
• 5 years’ experience required.

• Splunk Certification required:Must have a current Splunk Enterprise Certified Admin certification minimum. Preferred:
  Splunk Enterprise Certified Architect
• Preferred Security & Infrastructure Certifications (One or more): CompTIA Security+, CySA+, CASP+, Cisco CCNA/CCNP (Security or Enterprise), Palo Alto PCNSA/PCNSE, Check Point CCSA, Fortinet NSE, or (ISC)² SSCP/CISSP.