Cybersecurity Splunk SOAR Engineer Florida

Cybersecurity Splunk SOAR Engineer

Location:

USA, FL Mac Dill AFB

Full Time

Job Req: RQ211186

Regular Requisition

Clearance Level Must Currently Possess:
Top Secret/SCI

Clearance Level Must Be Able to Obtain:
Top Secret/SCI

Public Trust/Other

Required:

None

Job Family: IT Infrastructure and Operations

US Citizenship

Required:

Yes

Scheduled Weekly

Hours:

40

Travel Required:

Less than 10%

Telecommuting Options:
Onsite

Work Location:

USA FL Mac Dill AFB

• Design, deploy, and document the distributed Splunk SOAR platform architecture, ensuring high availability, performance, and scalability across the security domain.
• Develop and customize complex SOAR playbooks (Python or Phantom Playbook Editor) for automated enrichment, triage, containment, and remediation of security incidents such as phishing, malware, and unauthorized access.
• Integrate Splunk SOAR with a diverse ecosystem of security tools, including Splunk Enterprise Security (ES), firewalls, EDR/XDR, vulnerability scanners, threat intelligence platforms, and ticketing systems via API and custom app development.
• Manage and optimize data flow between Splunk ES and Splunk SOAR, ensuring security events and alerts trigger appropriate and effective automation actions.
• Create custom apps and integrations for Splunk SOAR to connect with proprietary or unique security tools not supported by out‑of‑the‑box integrations.
• Collaborate with SOC analysts, threat hunters, and incident response teams to gather requirements, document workflows, and translate manual security procedures into robust, automated playbooks.
• Establish and track metrics for SOAR utilization, automation coverage, and Mean Time to Respond (MTTR) reduction to demonstrate platform value and drive continuous improvement.
• Develop and maintain detailed documentation of all SOAR content, platform configurations, and integration architectures.

• Certifications: Applicable DoD 8140 or DoD 8570
• Experience: 8+ years related experience
• Required Skills:
  • Deep, hands‑on expertise with Splunk SOAR (Phantom) administration, configuration, and maintenance in a distributed, enterprise environment.
  • Advanced proficiency in Python scripting for developing and customizing SOAR playbooks, custom apps, and integrations.
  • Proven experience integrating SOAR with Splunk Enterprise Security (ES) and core security tools (EDR, TIP, SIEM).
  • Strong understanding of security operations principles, incident response life cycles, and threat detection methodologies.
  • Experience with RESTful APIs and developing connectors for tool interoperability.
  • Proficiency in data manipulation, security log parsing, and understanding of the Common Information Model (CIM) in a security context.
  • Strong verbal and written communication skills with the ability to articulate complex security automation concepts to technical and non‑technical audiences.
• Desired
  
  Skills:
  
  
  • Familiarity with cloud security logging, containerization (Docker/Kubernetes), and CI/CD pipelines for playbook deployment.
  • Knowledge of MITRE ATT&CK framework and its application in developing automated detection and response use cases.
  • Experience with Git or other version control systems for managing SOAR content.
  • Familiarity with network protocols, operating systems (Windows/Linux), and enterprise architecture components relevant to security monitoring.
  • Splunk Enterprise Security Certified Admin or Architect Certification.
  • Splunk Phantom / SOAR Certified Content Developer or Administrator Certification.
  • Experience with other SOAR platforms (Palo Alto Cortex XSOAR, IBM Resilient).
  • Experience in a USCENTCOM, DoD, or multi‑domain security operations environment.
  • ITIL 4 Foundation Certification.
• Security clearance level: TS/SCI clearance required.
• US citizenship required.
• Additional Responsibilities:
  • Support system upgrades, patching, and performance tuning across the Splunk SOAR infrastructure.
  • Provide advanced troubleshooting and support for SOAR platform issues and playbook execution errors.
  • Conduct training and mentorship for SOC staff on SOAR tool usage, basic content development, and best practices.
  • Evaluate and integrate emerging security technologies and threat intelligence feeds into the automation fabric.
  • Adhere to security best practices and compliance standards relevant to the operating environment.

Equal Opportunity Employer / Individuals with Disabilities / Protected Veterans.