Senior Splunk Engineer & Cyber Defense Analys

SPECIAL AEROSPACE SECURITY SERVICES INC • Alley, MO

6d • Onsite

About The Position

We are seeking an experienced Senior Splunk Engineer & Cyber Defense Analyst to lead SIEM engineering, detection content development, and proactive hunt operations for a major DoD program in Huntsville. This hybrid role combines deep Splunk engineering expertise with hands-on cyber threat hunting across classified environments. You will own the performance, scale, and security of a multi‑terabyte/day Splunk Enterprise ecosystem while driving hypothesis-based hunts and guiding analysts across the SOC. This position reports to both the SOC Manager and the Program ISSM.

Requirements

• Active DoD TS/SCI (U.S. Citizenship required)
• 8+ years in Cyber/IT, including: 5+ years Splunk Administration, 3+ years operational threat hunting
• Expert-level Splunk ES, CIM, btool, and search optimization experience
• Meets DoDM 8140.03 qualification for DCWF 511 or 531 (Intermediate+)
• Qualifying certifications: GCIA, GCIH, GCFA, GCDA, GNFA, or CySA+
• Security+ CE (or equivalent IAT II/III baseline requirement)
• Strong Python (Splunk SDK), Bash, and/or PowerShell scripting

Nice To Haves

• Experience with Cribl Stream/Edge
• Advanced Splunk certifications (Architect, Consultant)
• Cloud telemetry integration experience (AWS GovCloud or Azure Gov IL5/IL6)

Responsibilities

• Architect, deploy, and sustain clustered Splunk Enterprise 9.x+ environments (SHC, Indexer Clustering, Cluster Master) on RHEL 8/9
• Engineer data ingestion pipelines
• Develop dashboards (Dashboard Studio), SPL searches, macros, and Python-based commands
• Perform security monitoring procedures to identify, analyze and respond to cybersecurity events and incidents
• Conduct proactive hunts based on MITRE ATT&CK across endpoint, network, and cloud telemetry
• Lead Risk-Based Alerting (RBA) and TI Framework development within Splunk ES
• Build and tune detections using SPL or Sigma
• Perform deep-dive incident investigations and support JFHQ-DODIN reporting
• Serve as the technical escalation point for the SOC
• Mentor Tier 4-8 analysts in SPL, detection engineering, and adversary TTPs

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed
• Number of Employees: 1-10 employees