SIEM Subject Matter Expert (Splunk)

Accenture Federal Services • Washington, DC

4d • $109,500 - $224,200

About The Position

The Splunk Enterprise Security Subject Matter Expert will manage and optimize a large-scale Splunk deployment, ensuring effective architecture and platform health for substantial log ingestion across numerous endpoints. The role enhances Security Operations Center (SOC) throughput through expert knowledge of Splunk and its integrations.

The role includes ownership of Splunk Enterprise Security architecture, sizing, and platform health; developing and tuning MITRE ATT&CK-mapped correlation rules and use cases; onboarding and normalizing data from diverse endpoint log sources; and building and maintaining SIEM-to-SOAR integrations for automated alert enrichment and response. The position also supports platform reporting, capacity planning, upgrades, patching, lifecycle management, troubleshooting, and SOC analyst training and mentoring.

Requirements

• 5 years of SIEM architecture or engineering experience, including experience with large-scale deployments ingesting significant daily data volumes.
• Bachelor's degree in Computer Science, Information Technology, or a related field; equivalent experience may be considered in lieu of a degree.
• Deep knowledge of Splunk architecture, Search Processing Language (SPL), and data onboarding.
• Experience integrating SIEM with SOAR platforms for automated response.
• Splunk Certified Architect certification; Splunk Enterprise Security Certified Admin is also considered.

Responsibilities

• Own Splunk Enterprise Security architecture, sizing, and platform health management.
• Develop and tune correlation rules and use cases mapped to the MITRE ATT&CK framework.
• Onboard new log sources and normalize data across a large, diverse endpoint environment.
• Build and maintain SIEM-to-SOAR integrations that drive automated alert enrichment and response.
• Produce Splunk platform performance reporting and capacity-planning recommendations.
• Support platform upgrades, patching, and lifecycle management.
• Train and mentor SOC analysts on Splunk use and best practices.
• Troubleshoot platform performance and data-quality issues.

Benefits

• A collaborative and caring community where employees can belong and grow.
• Hands-on experience, certifications, and industry training.
• A wide variety of benefits; details are available through the company's benefits information.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior