Senior Splunk Detection Engineer

Emploi pas sur LinkedIn

🕒 il y a 27 jours

Postuler Maintenant

Trouver des Emplois à Distance Similaires

Configurer une alerte email pour les nouveaux emplois

📊 Vérifiez votre score de CV pour ce poste

Améliorez vos chances d'obtenir un entretien en vérifiant votre score de CV avant de postuler.

Télécharger le CV

Cherokee Federal

Site WebLinkedInTous les Emplois

5001 - 10000 employés

Fondée en 1969

🏥 Santé

📦 Logistique

🏭 Fabrication

Healthcare • Logistics • Manufacturing

Cherokee Federal est un intégrateur de systèmes fédéraux américains et un contractant gouvernemental qui favorise le succès de la mission pour plus de 60 agences fédérales américaines. Avec une main-d'œuvre mondiale de plus de 5 000 employés, il fournit des technologies avancées (cloud, cybersécurité, données et analyses), des services de santé, des analyses de renseignement et un support opérationnel, une logistique et un soutien, une fabrication essentielle pour les missions, des services techniques de programme et d'ingénierie, ainsi que des solutions contractuelles dynamiques pour soutenir les priorités fédérales et la sécurité nationale. Cherokee Federal fait partie de Cherokee Nation Businesses et se concentre sur des solutions axées sur la mission, fabriquées aux États-Unis.

Description

• Design, build, test, and continuously improve Splunk Enterprise Security detection content. • Develop and tune correlation searches, notable events, adaptive response actions, dashboards, and investigation workflows. • Implement and optimize Risk-Based Alerting (RBA) strategies. • Improve detection quality while reducing false positives and minimizing false negatives. • Map detections to the MITRE ATT&CK Framework and maintain coverage metrics. • Partner with Incident Response teams to convert real-world incidents into improved detection content. • Participate in threat hunting, incident investigations, tabletop exercises, and purple team activities. • Develop cloud detections leveraging AWS GuardDuty, CloudTrail, Security Hub, IAM, EC2, S3, VPC Flow Logs, and related telemetry. • Maintain Common Information Model (CIM) compliance and improve data normalization. • Measure detection quality through precision, recall, MTTR, and analyst workload reduction. • Support future Splunk SOAR (Phantom) automation initiatives. • Integrate Splunk Enterprise Security with ServiceNow Incident Response and other security technologies. • Collaborate with Security Operations, Cloud Engineering, Vulnerability Management, and Incident Response teams. • Performs other job-related duties as assigned.

🎯 Exigences

• Active Public Trust clearance or the ability to obtain one. • Minimum seven (7) years of cybersecurity experience, including four (4) years in Detection Engineering, Security Operations, Incident Response, or Splunk Enterprise Security. • Experience building and tuning Splunk Enterprise Security correlation searches. • Hands-on Risk-Based Alerting (RBA) implementation experience. • Practical Incident Response experience or close partnership with IR teams. • Strong understanding of MITRE ATT&CK. • Experience improving detection fidelity and reducing false positives. • Strong AWS security knowledge including GuardDuty, CloudTrail, Security Hub, IAM, EC2, S3, and VPC Flow Logs. • Proficiency with SPL, Python, REST APIs, and Git. • Experience developing Splunk dashboards, reports, and investigations. • Excellent written and verbal communication skills.

🏖️ Avantages

• Medical • Dental • Vision • 401(k) • Other possible benefits as provided