Splunk Incident Detection Engineer / Subject Matter Expert (SME)

Location: Rockville, MD (Primarily Onsite)
 

Position Summary

The Splunk Incident Detection Engineer / SME serves as a senior cybersecurity detection engineering expert responsible for designing, developing, tuning, and maintaining advanced detection capabilities within Splunk Enterprise Security (ES). This position plays a critical role in identifying configuration weaknesses, policy violations, insider threats, emerging cyber threats, and Advanced Persistent Threats (APTs) through the development of high-fidelity correlation searches, risk-based detections, and threat analytics.

The engineer is responsible for ensuring the quality, integrity, and operational health of security telemetry across the enterprise while maintaining strict adherence to the Splunk Common Information Model (CIM). The role requires a deep understanding of adversary tactics, techniques, and procedures (TTPs), threat hunting methodologies, enterprise logging architectures, and large-scale SIEM engineering.

A key function of this position is the development of highly efficient detection content that minimizes infrastructure impact through the strategic use of accelerated data models, summary indexing, and optimized search methodologies to reduce CPU, memory, and disk utilization across production Splunk environments.

Key Responsibilities

Detection Engineering and Content Development

• Design, develop, test, deploy, and maintain correlation searches within Splunk Enterprise Security.
• Create detections for:
  • Advanced Persistent Threats (APTs)
  • Insider threats
  • Credential compromise
  • Account misuse
  • Lateral movement
  • Privilege escalation
  • Defense evasion
  • Persistence mechanisms
  • Malware and ransomware activity
  • Command and Control (C2) communications
  • Cloud security threats
  • Configuration and compliance violations
  • Unauthorized administrative activity
• Develop detections aligned with the MITRE ATT&CK framework.
• Implement Risk-Based Alerting (RBA) methodologies to improve detection fidelity and reduce alert fatigue.
• Continuously review and tune existing correlation searches to improve signal-to-noise ratio and operational effectiveness.
• Develop custom threat detection logic based on intelligence reporting, adversary behavior, and emerging threat campaigns.
• Conduct post-incident reviews to identify detection gaps and implement new monitoring capabilities.

Common Information Model (CIM) Compliance

• Ensure all applicable log sources maintain compliance with the Splunk Common Information Model (CIM).
• Validate field mappings and data model compatibility across multiple technologies and security platforms.
• Create and maintain CIM-compliant field extractions, event types, tags, aliases, and calculated fields.
• Conduct periodic audits of existing data sources to identify CIM mapping deficiencies.
• Collaborate with data owners and administrators to correct normalization issues impacting detection capabilities.

Detection Performance Optimization

• Design correlation searches using performance-focused development methodologies.
• Prioritize the use of:
  • Accelerated Data Models
  • tstats searches
  • Summary indexing
  • Efficient lookup structures
  • Optimized search constraints
• Reduce unnecessary CPU, memory, storage, and search head workload.
• Analyze search performance metrics and remediate inefficient detections.
• Optimize scheduling, cron execution, and search concurrency to support enterprise-scale deployments.
• Evaluate data model acceleration health and performance impact.
• Develop standards and governance for efficient Splunk content development.

Threat Detection and Threat Hunting

• Proactively identify gaps in detection coverage.
• Conduct advanced threat hunting activities across enterprise data sources.
• Translate threat intelligence into actionable detection content.
• Analyze attacker methodologies and develop detections for emerging threats and zero-day exploitation techniques.
• Map detection coverage against MITRE ATT&CK and other industry frameworks.
• Assist incident response teams with investigative support and forensic analysis.

Required Qualifications

Education

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or equivalent experience.

Experience

• 5+ years of hands-on experience with Splunk Enterprise and Splunk Enterprise Security.
• 5+ years of cybersecurity operations, detection engineering, or security monitoring experience.
• Demonstrated experience developing advanced Splunk correlation searches and detection content.
• Experience supporting Security Operations Centers (SOCs) and incident response teams.
• Experience working with large-scale enterprise log management environments.

Technical Skills

• Expert knowledge of Splunk Search Processing Language (SPL).
• Advanced experience with:
  • Splunk Enterprise Security
  • Risk-Based Alerting (RBA)
  • Data Models
  • tstats
  • CIM
  • Knowledge Objects
  • Lookups
  • Summary Indexing
  • Scheduled Searches
  • Notable Event Framework
• Strong understanding of:
  • Windows security logging
  • Sysmon
  • Active Directory
  • Entra ID / Azure AD
  • Linux security logging
  • Cloud platforms (AWS, Azure, GCP)
  • Network security technologies
  • Endpoint Detection and Response (EDR)
  • Firewall and proxy telemetry
• Familiarity with:
  • MITRE ATT&CK
  • Cyber Kill Chain
  • NIST Cybersecurity Framework
  • Threat Intelligence Platforms

Preferred Qualifications

• Splunk Enterprise Certified Architect
• Splunk Enterprise Certified Admin
• Splunk Enterprise Security Certified Administrator
• GIAC certifications (GCIA, GCIH, GCDA, GMON, GMON)
• CISSP, CASP+, Security+, or equivalent certifications
• Experience implementing Detection-as-Code methodologies.
• Experience with SOAR platforms and automated response workflows.
• Experience with cloud-native logging and detection architectures.