Sr Splunk Engineer with Security Clearance

Postion: Sr Splunk Engineer Location: Joint Base San Antonio (JBSA), TX — 100% On-Site
Clearance Required: Active TS/SCI Position Overview
We are seeking an active TS/SCI cleared Senior Splunk Engineer to support mission-critical cyber operations for the 16th Air Force at Joint Base San Antonio. In this role, you will lead engineering efforts focused on advanced cybersecurity detection creation, telemetry pipeline integration, automated response workflows, and Splunk Enterprise Security (ES) optimization. This on-site position requires a subject matter expert with 5+ years of hands-on experience designing, troubleshooting, and tuning enterprise Splunk architectures and data pipelines.

Key Responsibilities & Scope of Work
Detection Engineering: Design, engineer, test, and optimize advanced cybersecurity detections and correlation rules within Splunk Enterprise Security (ES).

Telemetry & Pipeline Management: Integrate and optimize data ingestion pipelines, leveraging tools such as Cribl Stream to route, reduce, and transform telemetry prior to Splunk ingestion.

Automation & SOAR: Create, troubleshoot, and optimize automated response actions, playbooks, and security response workflows.

Dashboarding & Analytics: Build, optimize, and troubleshoot executive and analyst-facing Splunk dashboards, custom SPL queries, and alerting frameworks.

Reporting & Client Engagement: Prepare and deliver weekly status reports detailing completed work, technical roadblocks, and task allocations for program leadership.

Qualifications & Requirements
Clearance: Active TS/SCI Experience: 5+ years of dedicated, hands-on engineering experience in Splunk enterprise environments.

Technical Skills: Deep expertise in Splunk Core architecture, administration, and advanced SPL search optimization. Proven track record implementing and tuning Splunk Enterprise Security (ES).
Demonstrated background in detection engineering and security response automation. Preferred / Nice-to-Have
Experience with Cribl Stream / Splunk integration for data routing and pipeline optimization.
Hands-on experience with Splunk SOAR (Phantom) or Splunk IT Service Intelligence (ITSI).
Splunk Enterprise Certified Architect or Admin certification.