IT Security SIEM Engineer ( Splunk)

Responsibilities

• Provide engineering and administration support for ACS's Splunk environment (cloud and/or hybrid).
• Support search heads, indexers, deployers, deployment servers, heavy/universal forwarders, and Splunk applications.
• Onboard and normalize new log sources (application, database, network, cloud, endpoint).
• Develop and maintain complex Splunk queries, dashboards, reports, and alerts for both technical and executive audiences.
• Analyze log data for anomalies, suspicious trends, and potential security incidents.
• Design dashboards highlighting key security, operational, and performance metrics.
• Support log correlation and threat detection use cases aligned with SOC requirements.
• Absorb alerts to reduce false positives and improve detection efficiency.
• Work with stakeholders to gather requirements and deliver reporting solutions.
• Support day-to-day security monitoring activities in coordination with NYC SOC and internal teams.
• Assist in triage and analysis of security alerts and incidents.
• Support incident investigations by leveraging logs, endpoint data, and network telemetry.
• Absorb containment, eradication, and recovery actions when required.
• Contribute to incident response documentation and playbooks.
• Develop and maintain automation scripts (e.g., PowerShell, Python, Bash) to improve operational efficiency.
• Automate repetitive security tasks such as log ingestion validation, alert validation, reporting, and compliance checks.
• Support automation of endpoint configuration validation and security control verification.
• Absorb integrations between security tools where feasible.
• Improve dashboard automation and scheduled reporting capabilities.
• Assist in monitoring and managing endpoint security tools (e.g., EDR, antivirus, host-based monitoring tools).
• Support endpoint hardening initiatives and security configuration validation.
• Absorb vulnerability remediation coordination and tracking.
• Support security patch validation and compliance reporting.
• Analyze endpoint telemetry for suspicious behavior patterns.
• Support implementation of endpoint-related security improvements.
• Reviewing system logs for infrastructure components.
• Supporting firewall and network security log monitoring in coordination with OTI.
• Assisting with user access review processes and audit support.
• Supporting documentation of security configurations and architecture diagrams.
• Contributing to POAM tracking and remediation validation where required.
• Sustaining compliance reporting and audit evidence preparation.

Qualifications And Desired Skills

• Strong hands-on experience with Splunk Enterprise and/or Splunk Cloud.
• Experience with onboarding log sources and building detection logic.
• Knowledge of enterprise logging (application, web, database, security, endpoint).
• Experience with scripting languages (PowerShell, Python, Bash).
• Familiarity with endpoint detection and response (EDR) tools.
• Knowledge of incident response procedures.
• Understanding of log correlation and threat detection techniques.
• Experience with IDS/IPS and host-based security tools.
• Strong analytical and problem-solving skills.
• Ability to work independently and manage assigned tasks.
• Strong verbal and written communication skills.

Preferred Certifications

• Splunk Enterprise Certified Admin / Architect
• CISSP
• CEH
• GCIH
• Security+