Incident Response Analyst - Agentic SOC
About The Position
Join Splunk Global Security, the team that operates Splunk’s 24/7 global SOC and tests Splunk security products against real production threats. The role combines hands-on incident investigation with building, evaluating, and hardening agentic tooling used in investigations. You will help define how analysts and AI agents work together, including when agents can act autonomously, when human approval is required, and how to verify agent results. You will investigate alerts across Splunk’s product and enterprise environments, validate agent-assisted triage and enrichment, and scope incidents using Splunk Enterprise Security (Mission Control), SPL, EDR, identity, and cloud tools. You will collaborate with Detection Engineering to improve detections and address false positives, coverage gaps, and data-quality issues. You will also develop and maintain agent skills, prompts, integrations, and automated workflows; evaluate them using real-alert test cases and safeguards; and share structured product feedback with Enterprise Security, SOAR, and AI product teams.
Requirements
- At least 4 years of experience in security operations, incident response, or security monitoring, including alert triage and investigation using SIEM, EDR, identity, and cloud tooling.
- Knowledge of incident response processes and common attacker techniques.
- Experience with TCP/IP, DNS, HTTP, authentication flows, endpoint behavior, and cloud.
- Experience writing and troubleshooting security searches in SPL, KQL, SQL, or a similar query language.
- Experience reading and modifying Python or Bash automation and YAML/JSON configuration, and using playbooks with Git workflows such as branches, merge requests, and code review.
- Experience using LLM-based or agentic tools and verifying their output against raw evidence.
Nice To Haves
- Experience with Splunk Enterprise Security 8 (Mission Control), Splunk SOAR, or Splunk AI Assistant.
- Experience building agent tools or integrations, such as LLM tool calling, Model Context Protocol (MCP) servers, or retrieval-augmented generation (RAG) over runbooks and case history.
- Experience designing evaluations for LLM or agent output, including golden datasets, scoring rubrics, and regression tests, and running them in GitLab CI/CD pipelines with automated testing and approval gates.
- Knowledge of AI security risks, including the OWASP Top 10 for LLM Applications, prompt injection, and model data-handling controls.
- Clear written communication skills, including writing investigation notes, runbooks, and explanations of when and why an agent’s conclusion was wrong.
Responsibilities
- Triage, investigate, and respond to alerts across Splunk product and enterprise environments, using agentic triage and enrichment as a first pass and validating every verdict before acting.
- Scope incidents with Splunk Enterprise Security (Mission Control), SPL, and EDR, identity, and cloud tooling; collect evidence, document findings, and drive containment and resolution of critical issues.
- Partner with Detection Engineering to tune detections, reduce false positives, and address coverage or data-quality gaps identified by analysts or agents.
- Build and maintain agent skills, prompts, and integrations, including MCP servers, SOAR playbooks, and enrichment lookups, using GitLab merge requests and code review.
- Convert recurring manual procedures into tested, documented agent workflows and keep runbooks current.
- Evaluate and harden agent tooling using real-alert test cases, accuracy and false-verdict tracking, approval gates, autonomy limits, audit trails, and defenses against prompt injection, sensitive-data exposure, and over-privileged credentials.
- Run pre-release Splunk security AI as Customer Zero and deliver structured findings to Enterprise Security, SOAR, and AI product teams.
Benefits
- Medical insurance
- Dental insurance
- Vision insurance
- 401(k) plan with Cisco matching contribution
- Paid parental leave
- Short- and long-term disability coverage
- Basic life insurance
- Paid holidays and a floating holiday for non-exempt employees
- Birthday day off, year-end holiday shutdown, and paid personal wellness days
- Paid vacation time for non-exempt employees or flexible vacation time off for eligible exempt employees
- Paid sick time
- Additional paid time away may be requested for critical or emergency family issues
- Optional paid volunteer days
- Annual bonuses for eligible non-sales employees
- Potential Cisco restricted stock unit grants
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
Education Level
No Education Listed
