Cybersecurity Engineer

the Opportunity•Richmond, VA

12d•Onsite

About The Position

We are seeking an experienced Cybersecurity Engineer with deep hands-on expertise in Splunk Enterprise Security (SIEM) to help protect a large-scale enterprise technology environment. This role is ideal for a cybersecurity professional who enjoys working directly with security events, threat detection, incident investigation, log analysis, and threat hunting. You will use Splunk and other security technologies to identify suspicious activity, improve detection capabilities, investigate incidents, and strengthen the organization's overall security posture.

Requirements

8+ years of hands-on cybersecurity experience, including significant experience working with SIEM platforms and Splunk.
Strong hands-on experience with Splunk Enterprise Security.
Advanced proficiency writing and troubleshooting SPL queries.
Experience with threat detection, threat hunting, security monitoring, and incident response.
Strong understanding of networking, firewalls, EDR, and endpoint security.
Experience with cloud environments such as AWS, Microsoft Azure, or GCP.
Knowledge of MITRE ATT&CK and cybersecurity frameworks.
Familiarity with security and compliance standards such as NIST, HIPAA, and SOC 2.
Strong analytical, troubleshooting, and critical-thinking abilities.
Ability to manage multiple security incidents and priorities in a fast-paced environment.
Strong written and verbal communication skills.
Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related discipline.

Nice To Haves

Relevant Splunk certifications are highly preferred, including: Splunk Core Certified User, Splunk Core Certified Advanced Power User
Other relevant Splunk or cybersecurity certifications

Responsibilities

Monitor network traffic, endpoint logs, cloud security events, and other data sources for suspicious or malicious activity.
Use Splunk Enterprise Security to detect, analyze, investigate, and respond to cybersecurity threats.
Write and optimize SPL (Splunk Processing Language) queries for security monitoring and threat investigation.
Create and tune Splunk correlation searches, alerts, dashboards, and detection rules to improve accuracy and reduce false positives.
Perform threat hunting and investigate potential security incidents using log and forensic evidence.
Partner with infrastructure, networking, and IT teams to contain and remediate security threats.
Develop and refine security detection use cases and incident response playbooks.
Leverage MITRE ATT&CK techniques to strengthen threat detection and response capabilities.
Onboard and integrate new log and security data sources into the SIEM environment.
Ensure proper log parsing, normalization, integrity, and visibility.
Support security audits and compliance reporting by collecting SIEM evidence and documentation.