Security Engineer III, Splunk Content Engineer (Secret Clearance)

About the role

Join our Deloitte Cyber team to deliver powerful solutions that help clients navigate the ever-changing threat landscape. Through managed services and automation, we enable clients to operate with resilience, grow with confidence, and proactively manage security challenges.

Responsibilities

• Implement automation to optimize workflows and improve security response uniformity across client environments
• Develop content for security platforms such as Splunk, Archer, Tanium, Trellix, FireEye, and CrowdStrike
• Build, implement, and manage security information and event management (SIEM) correlation rules, logic, and content
• Tune SIEM rules and logic to reduce false positives, known errors, and expected network behavior
• Create scheduled and ad hoc reporting, maintain event schemas, and apply customized security severity criteria

Skills

• Ability to work independently and collaborate as part of a team
• Effective written and verbal communication skills
• Meticulous attention to detail and quality of work product
• Ability to build and sustain professional relationships
• Ability to lead projects or workstreams
• Ability to manage and prioritize multiple tasks in a fast-paced and dynamic environment
• Strong interpersonal skills and professional demeanor
• Ability to meet deadlines
• Ability to mentor and provide clear guidance to others

About the team

Deloitte's Government & Public Services (GPS) practice serves federal, state, and local government clients, as well as public higher education institutions. Our Cyber Defense & Resilience offering helps clients defend against advanced threats by transforming security operations, monitoring technology, data analytics, and threat intelligence. We assist in managing and protecting dynamic attack surfaces and provide rapid crisis and cyber incident response.

The Project Delivery Talent Model is designed for professionals with specialized skills aligned to current client needs. Team members focus on delivering services without additional business development or promotion expectations. Employment is tied to project roles, with a competitive benefits package for project delivery-focused professionals.

Qualifications

• Bachelor's Degree or relevant experience in lieu of degree required
• Active Secret Clearance required
• Ability to work onsite in Herndon, VA up to 3 days a week
• 2+ years of experience in the following:
  • Developing, implementing, and managing SIEM correlation rules and content
  • Building and implementing event correlation rules, logic, and content in a SIEM environment
  • Tuning event correlation rules and logic to filter security events associated with known network behavior, false positives, and known errors
  • Maintaining an event schema with customized security severity criteria
  • Creating scheduled and ad hoc reporting with SIEM tools
  • Working with SIEM technologies and event collector deployments in Windows and Linux operating environments
• Ability to travel 15%, on average, based on client needs
• Must be legally authorized to work in the United States without employer sponsorship

Preferred Qualifications

• Experience creating content for one or more of the following tools: Splunk, Archer, Tanium, Trellix, FireEye, or CrowdStrike
• Experience supporting cyber defense, security operations, or incident response environments
• Experience working with government clients or within regulated environments
• Experience automating security workflows and operational processes
• Experience leading technical workstreams or junior team members

Pay

The wage range for this role is $97,900 to $163,100. The range considers factors such as skill sets, experience, training, licensure, certifications, and business needs. Compensation decisions depend on individual circumstances. You may also be eligible for a discretionary annual incentive program based on individual and organizational performance.