Splunk / SIEM Engineer

Role: SIEM Engineer
Location: Keystone Building, 5th Floor, Harrisburg, PA 17120

• Engineer, configure, maintain, and optimize the enterprise SIEM platform, including Splunk and related security technologies.
• Onboard new data sources and ensure proper log collection, parsing, normalization, indexing, and retention.
• Develop and maintain correlation searches, alerts, dashboards, reports, detection rules, and security monitoring content.
• Integrate SIEM capabilities with security tools, cloud platforms, applications, infrastructure, and enterprise systems.
• Monitor platform performance, capacity, availability, and overall health; troubleshoot technical issues as needed.
• Tune alerts and detection logic to reduce false positives and improve threat detection effectiveness.
• Provide technical support to SOC analysts and incident response teams, including queries, dashboards, and investigative capabilities.
• Support upgrades, patches, configuration changes, testing, and SIEM infrastructure implementation.
• Maintain technical documentation, operational procedures, system configurations, and knowledge-transfer materials.
• Collaborate with SOC, infrastructure, cloud, networking, and application teams on SIEM initiatives.
• Follow Commonwealth security standards, change-management processes, and applicable cybersecurity policies.

• Strong hands-on experience with Splunk and enterprise SIEM engineering.
• Experience with log ingestion, parsing, normalization, indexing, and retention.
• Proficiency in developing correlation searches, detection rules, alerts, dashboards, and reports.
• Experience integrating SIEM platforms with cloud, infrastructure, application, and security technologies.
• Strong troubleshooting, performance optimization, and alert-tuning skills.
• Experience supporting SOC operations, threat detection, and incident response.
• Excellent technical documentation and cross-functional collaboration skills.

• Prioritize candidates with strong hands-on Splunk/SIEM engineering experience.
• Confirm the candidate's willingness to work onsite in Harrisburg, PA, three days per week.
• Clearly communicate that the interview process requires an in-person interview.
• Validate the candidate's technical expertise and availability before submission.
• Share the updated resume along with the candidate's current location, work authorization, availability, contact information, and rate confirmation.