Sr Security Engineer with SPLUNK/SIEM

Job description:

Location: Harrisburg, PA 17120 (Hybrid — 3 days/week onsite, Keystone Building, 5th Floor)

Interview Format: In-Person

Reporting To: Director of Security

Position Overview

We are seeking a SIEM Security Engineer to provide specialized hands-on technical support for our Enterprise Security Information and Event Management (SIEM) environment. You will support the design, configuration, integration, optimization, and daily operations of the SIEM platform (Splunk) to strengthen enterprise security monitoring, threat detection, incident response, and log management.

Note: Strategic direction, governance, and overall program oversight remain under the leadership of the Director.

Key Responsibilities

• Platform Engineering & Maintenance: Engineer, configure, maintain, and optimize the enterprise SIEM platform (Splunk and related security tools). Execute upgrades, patches, testing, and system changes while maintaining platform health, capacity, and availability.
• Data Onboarding & Log Management: Onboard new data sources. Parse, normalize, index, and manage retention for incoming logs using syslog, APIs, agents, and cloud integrations.
• Detection & Content Development: Build and maintain correlation searches, custom alerts, dashboards, reports, detection rules, and security monitoring content.
• Alert Tuning & Troubleshooting: Fine-tune detection logic and alerts to minimize false positives. Resolve complex SIEM, data ingestion, and integration issues.
• System & Tool Integration: Integrate SIEM capabilities with security infrastructure, cloud platforms, networks, and enterprise applications.
• SOC & Incident Response Support: Provide technical expertise, custom SPL queries, dashboards, and investigative support to SOC analysts and incident response teams.
• Governance & Documentation: Maintain system configurations, operational procedures, and technical documentation. Follow change-management workflows, security standards, and policy compliance guidelines.

Qualifications & Requirements

Required Qualifications

• Experience: Minimum 3 years of professional IT experience in SIEM, security engineering, SOC operations, or security monitoring technologies.
• Splunk Administration: Minimum 3 years administering or engineering Splunk Enterprise and/or Splunk Enterprise Security.
• Log Ingestion: Minimum 3 years onboarding and integrating log sources via syslog, APIs, forwarders/agents, or cloud-native integrations.
• Certification: Splunk Enterprise Certified Admin (Required).

Highly Desired Qualifications

• Experience engineering SIEM solutions within large enterprise or government environments.
• Strong proficiency in developing complex Search Processing Language (SPL) queries, dashboards, alerts, and correlation searches.
• Hands-on experience troubleshooting complex logging pipelines and data ingestion failures.
• Familiarity with industry cybersecurity frameworks (NIST CSF, MITRE ATT&CK).