Splunk Detection Engineer

Boston Government Services, LLC (BGS) is an engineering, technology, and security firm that supports government programs and national security facilities. They are seeking a Splunk Detection Engineer to integrate data sources, validate configurations, and develop detection capabilities within Splunk Enterprise Security.

Responsibilities:

• Integrate new data sources, which may include databases, APIs, files, etc. This may involve setting standards and working with IT administrators to update their configurations
• Validating and creating appropriate configurations for CIM compliant logs
• Processing requests from cybersecurity analysts for new detections within Splunk Enterprise Security
• Analyzing existing logs to identify poorly formatted logs and potential gaps when implementing new detections
• Adding and maintaining threat feeds within Splunk Enterprise Security
• Monitoring the performance of and tuning detections
• Managing asset and identity inventory within Splunk Enterprise Security
• Creating and maintaining new Splunk apps
• Recommending additions or changes to Splunk or its data models to meet detection needs
• Developing searches, reports, and other functionalities for cyber-based use-cases, including active response, intrusion detection, vulnerability management, and related use cases
• Assisting users with creating and optimizing searches and dashboards and mentoring others in good development of said resources
• Attend online/Teams meetings with team and others as appropriate
• Work with team to provide status on current task, suggest improvements, discuss implementation, etc
• Capture business requirements and implement the requirements
• Analyze data and perform initial planning to address identified issues
• Assist with the creation of playbooks to address identified issues from analysts
• Seek to understand the intention of detections and corresponding playbooks
• Provide basic feedback on existing playbooks and detections
• Identify telemetry quality and visibility issues (SIEM parsing/normalization, EDR/XDR sensor health, asset/identity tagging)
• Provide advanced recommendations to address gaps in logging and detections based on an analysis of threats and data
• Create detailed and thorough testing plans to ensure higher chance of accurate detections
• Produce clear metrics and reports (FP rate, backlog) for technical and executive audiences
• Create advanced use cases for detections based on an analysis of threats and data, including sample criteria to identify the behavior and mapping detections to MITRE Telecommunication & CK
• Drive continuous improvements to existing processes or tooling
• Perform quality reviews and improve detections and actions
• Coach, guide, teach others on the team in use of Enterprise Security

Requirements:

• Significant experience with Splunk and Splunk Enterprise Security
• Significant experience with event logging solutions (e.g., Splunk Universal Forwarder, syslog, Cribl)
• Experience with ticketing/case management
• Experience with Git pipelines
• Familiarity with using Linux CLI
• Ability to craft queries using common languages; comfort with regex, JSON and APIs; basic scripting in Python/PowerShell/Bash
• Excellent analytical, problem-solving, and communication skills both with stakeholders, peers, and internal customers; able to operate under pressure in a shift or on-call environment
• Considerable knowledge using and administering Splunk
• Staying up to date with the latest cybersecurity threats, vulnerabilities, and best practices
• Strong analytical and problem-solving skills
• Meticulous attention to detail to ensure thorough assessments and accurate reporting
• Excellent written and verbal communication skills to effectively convey findings and recommendations to technical and non-technical stakeholders
• Ability to work collaboratively with other cybersecurity professionals, IT staff, and external vendors
• Experience and skill in conducting audits or reviews of technical systems
• Experience working in a government environment
• Experience working in a distributed IT environment
• Ability to qualify for HSPD-12 card for use in two-factor authentication
• Strong grasp of TCP/IP, OSI model, and common protocols (HTTP, DNS, SMTP). Windows/Linux/macOS fundamentals; Active Directory/Azure AD concepts; basic cloud logging
• Experience in system and network administration
• Relevant cybersecurity experience including investigations and data analysis
• Experience with SOAR tools and automation development
• Experience using identity security/management tools (e.g., Entra ID, Active Directory, Shibboleth, CrowdStrike Identity Protection)
• Cloud security experience (e.g., CloudTrail/GuardDuty, Azure Defender/M365, GCP Security Command Center)