Splunk Engineer/Architect

About the role

Piper Companies is seeking a Splunk Engineer / Architect to support a leading organization in the cybersecurity and enterprise technology industry. The Splunk Engineer / Architect will play a critical role in designing, implementing, and optimizing enterprise-scale Splunk environments within a SOC, with a strong focus on backend engineering and architectural design rather than dashboarding or end-user analytics. This is a long term contract opportunity requiring an active Secret Clearance and onsite work in RTP, NC, five days per week.

Responsibilities

• Design and deploy scalable, highly available Splunk architectures across on-prem, cloud, and hybrid environments.
• Lead Splunk engineering efforts including installation, configuration, upgrades, and ongoing platform maintenance (indexers, search heads, forwarders, clustering).
• Develop and execute data ingestion strategies, including onboarding, normalization, parsing, and performance optimization.
• Establish governance, platform standards, and best practices to ensure long-term scalability and reliability.
• Support SOC operations by building and tuning SIEM use cases, correlation searches, and alerts aligned with MITRE ATT&CK.
• Collaborate with cybersecurity and infrastructure teams to enhance threat detection, monitoring, and incident response capabilities.

Requirements

• Active Secret Clearance required.
• 5+ years of hands-on Splunk Engineering/Architecture experience (backend focus, not dashboarding).
• Strong expertise with Splunk Enterprise and Splunk Enterprise Security (ES) in large-scale environments.
• Deep understanding of data ingestion, indexing, clustering (indexer/search head), and search optimization.
• Experience supporting Splunk within a SOC and contributing to SIEM/security monitoring strategies.

Pay

$140,000–$180,000

Benefits

• Full comprehensive benefits including health, vision, and dental coverage.
• Paid time off and paid holiday and sick leave where required by law.