Splunk Content Engineer

Blu Omega is seeking a Splunk Content Engineer to join a dynamic Security Operations Center (SOC) team where your expertise will be pivotal in shaping our organization's cybersecurity defense. You'll design, optimize, and maintain Splunk detection content, dashboards, and automation workflows that empower analysts to rapidly identify and respond to threats across diverse environments—including traditional IT, IoT, and OT systems. This role offers a unique opportunity to influence security operations in a rapidly evolving threat landscape, ensuring our organization stays one step ahead of cyber adversaries.

• 3 days onsite in Herndon, VA
• 2 days remote

• Active Secret clearance required

• Design, develop, and refine Splunk correlation searches, dashboards, and alerts focused on detecting cybersecurity threats across IT, IoT, and OT environments.
• Build automation workflows, investigative queries, and response playbooks that support efficient incident triage and response, with particular attention to IoT and OT protocols and behaviors.
• Collaborate closely with SOC analysts and engineers to minimize false positives, enhance alert accuracy, and continuously improve detection logic.
• Ensure detection content aligns with organizational security priorities, adapting to emerging threats and new operational environments.

• Hands‑on experience developing, implementing, and managing Splunk correlation rules and security content.
• Demonstrated ability to design and implement event correlation logic within Splunk environments.
• Proven experience tuning correlation rules to reduce noise, false positives, and known errors.
• Experience maintaining event schemas and applying customized severity criteria within Splunk.
• Ability to create and maintain scheduled and ad hoc reports in Splunk.
• Strong understanding of Splunk architecture, data ingestion methods, including event collector deployment in Windows and Linux environments.
• Excellent written and verbal communication skills, capable of conveying technical concepts clearly to non‑technical audiences.

• Familiarity with IoT and OT security protocols and behaviors.
• Experience with automation tools such as scripting in Python, Power Shell, or Bash.
• Knowledge of additional security information and event management (SIEM) platforms.
• Certifications such as Splunk Certified Enterprise Security Admin or SPLK-3001 are a plus.