Senior Splunk Detection Engineer

Cherokee Federal

Senior Splunk Detection Engineer improving Security Operations Center effectiveness through high-fidelity detections for the National Science Foundation Cybersecurity & Privacy Program.

Posted 7/10/2026full-timeRemote • 🇺🇸 United StatesSenior💰 $150,000 - $160,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in Splunk Enterprise Security, including detection content design, Risk-Based Alerting implementation, and incident response collaboration. Proficient in AWS security tools and frameworks, with a strong focus on improving detection fidelity and compliance.

Highest-signal resume keywords

Splunk Enterprise SecurityRisk-Based Alerting (RBA)MITRE ATT&CK FrameworkAWS Security (GuardDuty, CloudTrail, Security Hub)SPL, Python, REST APIs

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Detection EngineeringCorrelation SearchesIncident ResponseData NormalizationDetection Fidelity ImprovementDashboard DevelopmentPrecision and Recall MeasurementFalse Positive ReductionCloud DetectionsAutomation Initiatives

Soft Skills

Excellent Written CommunicationExcellent Verbal Communication

Tools & Technologies

SplunkAWSServiceNowGit

Certifications & Qualifications

Active Public Trust Clearance

Industry Keywords

CybersecuritySecurity OperationsIncident ResponseThreat HuntingPurple Team Activities

Tech Stack

Tools & technologies

AWSCloudCyber SecurityEC2PythonServiceNowSplunk

About the role

Key responsibilities & impact

Design, build, test, and continuously improve Splunk Enterprise Security detection content.
Develop and tune correlation searches, notable events, adaptive response actions, dashboards, and investigation workflows.
Implement and optimize Risk-Based Alerting (RBA) strategies.
Improve detection quality while reducing false positives and minimizing false negatives.
Map detections to the MITRE ATT&CK Framework and maintain coverage metrics.
Partner with Incident Response teams to convert real-world incidents into improved detection content.
Participate in threat hunting, incident investigations, tabletop exercises, and purple team activities.
Develop cloud detections leveraging AWS GuardDuty, CloudTrail, Security Hub, IAM, EC2, S3, VPC Flow Logs, and related telemetry.
Maintain Common Information Model (CIM) compliance and improve data normalization.
Measure detection quality through precision, recall, MTTR, and analyst workload reduction.
Support future Splunk SOAR (Phantom) automation initiatives.
Integrate Splunk Enterprise Security with ServiceNow Incident Response and other security technologies.
Collaborate with Security Operations, Cloud Engineering, Vulnerability Management, and Incident Response teams.
Performs other job-related duties as assigned.

Requirements

What you’ll need

Active Public Trust clearance or the ability to obtain one.
Minimum seven (7) years of cybersecurity experience, including four (4) years in Detection Engineering, Security Operations, Incident Response, or Splunk Enterprise Security.
Experience building and tuning Splunk Enterprise Security correlation searches.
Hands-on Risk-Based Alerting (RBA) implementation experience.
Practical Incident Response experience or close partnership with IR teams.
Strong understanding of MITRE ATT&CK.
Experience improving detection fidelity and reducing false positives.
Strong AWS security knowledge including GuardDuty, CloudTrail, Security Hub, IAM, EC2, S3, and VPC Flow Logs.
Proficiency with SPL, Python, REST APIs, and Git.
Experience developing Splunk dashboards, reports, and investigations.
Excellent written and verbal communication skills.

Benefits

Comp & perks

Medical
Dental
Vision
401(k)
Other possible benefits as provided