Senior Splunk Engineer - Independence

- Design, implement, and sustain Splunk Enterprise installations, including indexers, search heads, and other components across both on-premise and AWS environments - Create scalable data onboarding solutions, including parsing and indexing through various ingestion methods - Enforce governance policies including RBAC, data retention, and compliance with federal regulations - Enhance search performance, manage data model accelerations, and optimize event throughput within the ES framework - Produce and refine ES correlation searches, risk-based alerts, and adaptive responses in line with MITRE ATT&CK - Construct dashboards and workflows for investigations, minimizing false positives and improving analyst productivity - Maintain data models that comply with CIM standards while leading efforts in data normalization and quality assurance - Assess and communicate the effectiveness of detection and response capabilities - Develop Splunk SOAR playbooks with secure configurations for efficient threat management - Synchronize ES notables with automated incident responses and with ServiceNow for tracking and processing incidents - Implement detection and response strategies for AWS platforms, including automation for security actions - Integrate EDR and identity platforms for host mitigation and incident handling - Lead Splunk setup in AWS, focusing on scalability and automation - Standardize Python module usage and CI/CD practices for deployment - Align operations with FISMA/NIST RMF and maintain audit readiness through systematic logging and evidence tracking - Conduct continuous validation of controls and updates on necessary documentation - Advocate for strong security practices in all engineering changes and automation projects - Convert SOC/IR runbooks into proficient detections and automations - Mentor junior engineers on best practices in SPL, ES development, and automation processes - Collaborate with stakeholders to prioritize security use cases and deliver measurable results - Undertake additional tasks as assigned.