Splunk Engineer

Responsibilities

• Implement RBA strategies within Splunk ES to reduce alert noise
• Build actionable alerts, workflow actions, risk incident rules, and risk scores
• Design custom dashboards to visualize risk scores and provide context
• Correlate disparate events to identify patterns of risky behavior
• Develop custom machine learning models and automated workflows
• Develop advanced security content including dashboards and reports
• Collaborate with owners to onboard data sources from Windows, Linux, AWS, and Azure
• Correlate logs from operating systems, applications, and cloud providers

Requirements

• Splunk Core Certified Consultant certification
• Deep expertise in Splunk administration, architecture, and SPL
• Strong understanding of security operations, threat detection, and incident response
• Knowledge of security frameworks such as NIST RMF
• Proficiency in Python, PowerShell, or Bash
• Ability to work within an agile environment

Preferred Qualifications

• Splunk Core Certified Power User
• Splunk Enterprise Certified Admin
• Splunk Enterprise Certified Architect
• Splunk ES certification

Benefits

• Competitive salary paid twice per month
• 100% medical premium coverage
• 401k with 100% company match on the first 4%
• 3 weeks PTO and 11 paid holidays
• Monthly reimbursement for cell phone and home internet
• Investment in training and certifications

About the Company

True Zero Technologies is a veteran-owned small business focused on the purposeful enablement of people and technology to deliver top-tier services.