Splunk Detection Engineer
DivIHN Integration Inc
- Saint Paul, Illinois, United States
- Saint Paul, Illinois, United States
Über
Splunk Detection Engineer (Level IV or Strong Level III) 12+ months • Fully Remote Scope:
The Splunk Detection Engineer will play an important role in ensuring that security logs are appropriately formatted, ingested, tagged, and used to detect possible security events. Typical tasks may include: Integrate new data sources, which may include databases, APIs, files, etc. This may involve setting standards and working with IT administrators to update their configurations Validating and creating appropriate configurations for CIM compliant logs Processing requests from cybersecurity analysts for new detections within Splunk Enterprise Security Analyzing existing logs to identify poorly formatted logs and potential gaps when implementing new detections Adding and maintaining threat feeds within Splunk Enterprise Security Monitoring the performance of and tuning detections Managing asset and identity inventory within Splunk Enterprise Security Creating and maintaining new Splunk apps Recommending additions or changes to Splunk or its data models to meet detection needs Developing searches, reports, and other functionalities for cyber-based use-cases, including active response, intrusion detection, vulnerability management, and related use cases
Responsibilities Carry out activities to ensure proper formatting, ingestion, tagging, and utilization of security logs for detection of events Collaborate with cybersecurity analysts and IT teams to implement detections and data models Develop and maintain detections, searches, and dashboards in Splunk Enterprise Security Drive continuous improvement of processes, data quality, and tooling related to Splunk Provide guidance and knowledge transfer to team members on Splunk Enterprise Security usage
Qualifications Minimum Qualifications:
Significant experience with Splunk and Splunk Enterprise Security Significant experience with event logging solutions (e.g., Splunk Universal Forwarder, syslog, Cribl) Experience with ticketing/case management Experience with Git pipelines Familiarity with using Linux CLI Ability to craft queries using common languages; comfort with regex, JSON and APIs; basic scripting in Python/PowerShell/Bash Excellent analytical, problem-solving, and communication skills both with stakeholders, peers, and internal customers; able to operate under pressure in a shift or on-call environment
Preferred Additional Qualifications:
Strong grasp of TCP/IP, OSI model, and common protocols (HTTP, DNS, SMTP). Windows/Linux/macOS fundamentals; Active Directory/Azure AD concepts; basic cloud logging Experience in system and network administration Relevant cybersecurity experience including investigations and data analysis Experience with SOAR tools and automation development Experience using identity security/management tools (e.g., Entra ID, Active Directory, Shibboleth, CrowdStrike Identity Protection) Cloud security experience (e.g., CloudTrail/GuardDuty, Azure Defender/M365, GCP Security Command Center)
#J-18808-Ljbffr
Sprachkenntnisse
- English
Hinweis für Nutzer
Dieses Stellenangebot stammt von einer Partnerplattform von TieTalent. Klick auf „Jetzt Bewerben”, um deine Bewerbung direkt auf deren Website einzureichen.