Senior Security Engineer - Splunk

Make a difference here.

UltraViolet Cyber is a leading platform-enabled unified security operations company providing a comprehensive suite of security operations solutions. Founded and operated by security practitioners with decades of experience, the UltraViolet Cyber security-as-code platform combines technology innovation and human expertise to make advanced real-time cybersecurity accessible for all organizations by eliminating risks of separate red and blue teams.

By creating continuously optimized identification, detection, and resilience from today’s dynamic threat landscape, UltraViolet Cyber provides both managed and custom-tailored unified security operations solutions to the Fortune 500, Federal Government, and Commercial clients. UltraViolet Cyber is headquartered in McLean, Virginia, with global offices across the U.S. and in India.

Our Federal Delivery team is seeking a Senior Security Engineer specializing in Splunk to enhance our security monitoring, detection, and response capabilities within federal government environments. This role will be responsible for designing, implementing, and optimizing Splunk deployments to support advanced threat detection, security analytics, and compliance monitoring across critical infrastructure.

Design, implement, and maintain complex Splunk deployments for security monitoring, threat detection, data ingestion, and search optimization

Document and map the architecture of current Splunk infrastructure and lead the development of a security engineering roadmap for future improvements.

Develop and optimize Splunk searches, dashboards, and alerts to enhance security operations

Define and manage index clustering, search head clustering, and forwarder deployment.

Lead end-to-end Splunk deployment and configuration projects, including infrastructure planning, installation, and integration.

Troubleshoot complex Splunk issues involving search performance, indexing, ingestion, parsing, data availability, clustering, storage, authentication, configuration, and integrations with other security tools, as well as providing root-cause analysis of Splunk outages, degradation, data loss, ingestion issues and performance problems.

Conduct performance tuning and capacity planning for Splunk Environments

Collaborate with cross-functional teams to integrate Splunk with other security tools and data sources and analyze how Splunk interacts with other security tools throughout the broad security ecosystem.

Help lead discussions regarding Splunk optimization, modernization, consolidation, automation, scalability, and efficiency and develop recommendations for improving Splunk reliability, and availability

Lead the Cribl to Splunk integration and data pipeline optimization, ensuring efficient routing, filtering, transformation, and delivery data into Splunk as well as improve data quality, reduce ingestion, and enhance overall platform performance

Serve as the team’s point of contact for security tool operation and management and provide support to Splunk engineers and cross-functional teams.

Embed Splunk across a wide range of tools across Enterprise IT operations to ingest endpoint and firewall logs, analyze vulnerability scanning data, enhance privileged access monitoring and audit logging, monitor encryption and key management, and enhance threat detection and incident response.

Integrate tools such as CrowdStrike, Cribl, CyberArk, Tenable, CASB, Trellix, Axonius, and others.

US Citizenship is Required for hire and ability to clear Government clearance process

Master's degree in Cybersecurity, Information Security, or related field, plus 12 years of experience

7+ years of security engineering experience with 3+ years of advanced Splunk implementation

Splunk Certified Architect or Splunk Certified Enterprise Security Admin certification

Experience designing and implementing Splunk Enterprise Security in large environments, along with Cribl

Strong knowledge of SPL query language and advanced search techniques

Experience creating custom Splunk dashboards, reports, and visualizations

Demonstrated expertise in security monitoring and SIEM technology

Experience implementing security controls per NIST SP 800-53 requirements

Proficiency with Splunk administration and performance tuning

Experience supporting federal agency security operations centers

Splunk and Cribl certifications highly desired

Additional security certifications (CISSP, GCIA, GCIH, Security+)

Experience with Splunk implementations

Background in security architecture for government networks

Knowledge of CISA directives and CDM program requirements

Experience with cloud security monitoring using Splunk and Cribl

Familiarity with Zero Trust architecture implementation

Hybrid work model with 3 day/week on-site presence near National Harbor, Maryland

Must be able to pass a Federal background investigation - US Citizenship required

Participation in on-call rotation for security incident response

Collaboration with cross-agency security teams

401(k), including an employer match of 100% of the first 3% contributed and 50% of the next 2% contributed

Medical, Dental, and Vision Insurance (available on the 1st day of the month following your first day of employment)

Group Term Life, Short-Term Disability, Long-Term Disability

Voluntary Life, Hospital Indemnity, Accident, and/or Critical Illness

Participation in the Discretionary Time Off (DTO) Program

11 Paid Holidays Annually

laptop-ats-crawler v2