Security Engineer (Splunk & Automation) with Security Clearance

Piper Companies is seeking a Security Engineer (Splunk & Automation) to join a leading cybersecurity team supporting enterprise security operations. The Security Engineer will serve as a key technical resource responsible for Splunk development, security tool integrations, automation, and threat intelligence workflows that strengthen detection, investigation, and response capabilities. This role is ideal for candidates who have progressed from a SOC Analyst background into Security Engineering and enjoy building solutions that connect tools, data, and processes across the security ecosystem.

This is a fully on-site position in Durham, North Carolina form 8-5 PM EST that is a long term contract that has high likelihood for extension and conversion. Responsibilities of the Security Engineer (Splunk & Automation):

• Design, develop, and maintain integrations between Splunk, threat intelligence platforms, case management tools, and other security technologies.
• Build and support security automation solutions that improve SOC efficiency and accelerate incident response activities.
• Develop and maintain Splunk searches, alerts, dashboards, reports, data models, and custom applications.
• Integrate and operationalize threat intelligence feeds, enrichment workflows, and intelligence-sharing processes.
• Create Python-based automation to streamline security monitoring, investigations, and remediation efforts.
• Design and implement data quality and telemetry validation processes to ensure accurate and reliable security visibility.
• Collaborate with SOC analysts, threat intelligence teams, detection engineers, and platform owners to improve workflows and reduce manual effort.
• Perform data integrity monitoring and create alerts to identify gaps that could impact threat detection, compliance reporting, or incident response efforts.
• Support security platform interoperability through API integrations and custom engineering solutions.

Qualifications for the Security Engineer (Splunk & Automation):

• Active Secret Clearance required.
• 3+ years of experience in Security Engineering, Splunk Engineering, Security Automation, Detection Engineering, or a related cybersecurity role.
• Strong hands-on experience with Splunk Enterprise, including SPL, dashboards, alerts, saved searches, and reporting.
• Experience integrating security tools and platforms into Splunk environments.
• Strong Python scripting and automation experience.
• Understanding of SOC operations, incident response, threat detection, and security monitoring workflows.
• Experience leveraging APIs to integrate security technologies and workflows.
• Strong analytical, troubleshooting, and problem-solving skills.
• Excellent communication skills and ability to work cross-functionally with technical and non-technical stakeholders.

Preferred Qualifications for the Security Engineer (Splunk & Automation)

• Previous experience as a SOC Analyst who transitioned into Security Engineering or Security Operations Engineering.
• Experience with OpenCTI, TheHive, SOAR platforms, or other threat intelligence and case management solutions.
• Experience managing threat intelligence feeds and enrichment workflows.
• Knowledge of detection engineering and security operations best practices.
• Experience supporting enterprise cybersecurity environments.
• Familiarity with data integrity monitoring, telemetry validation, and security analytics.

Technical Environment

• Splunk Enterprise
• SPL
• Python
• OpenCTI
• TheHive
• Security Automation & SOAR
• REST APIs
• Threat Intelligence Platforms
• Detection Engineering
• Incident Response
• Security Analytics
• Data Quality & Telemetry Validation

Compensation for the Security Engineer (Splunk & Automation):

• $60-$66/hour (flexible for the right candidate)
• Medical, Dental, Vision, PTO, Holidays, and Sick Leave Required by Law

Keywords: Security Engineer, Splunk Engineer, Security Automation Engineer, Security Operations Engineer, Detection Engineer, Cybersecurity Engineer, Splunk Enterprise, SPL, Python, Threat Intelligence, OpenCTI, TheHive, SIEM, SOAR, Security Integrations, Incident Response, Detection Engineering, Security Analytics, API Integration, Security Monitoring, Secret Clearance. This position opened for applications on August 21, 2026, and will remain open for at least 30 days from the posting date. #LI-KI1 #LI-HYBRID