Yesterday
Top Secret/SCI
Mid Level Career (5+ yrs experience)
$175,000 - $210,000
CI Polygraph
IT - Software
Riverdale, MD (On/Off-Site)
Splunk Engineer
Location: Riverdale, MD (Defense Intelligence Contract) Clearance Requirement: Active TS/SCI Clearance w/ CI Polygraph
Position Overview
The Splunk Engineer supports enterprise-wide monitoring, alerting, and analytics across the customer’s operational and security environments. This position develops and maintains custom Splunk dashboards, visualizations, and alerts that provide actionable insights for NOC and SOC personnel. The engineer ensures data integrity, visibility, and system performance across mission-critical networks and applications supporting government operations. This role bridges IT operations and cybersecurity by delivering analytics solutions that enhance situational awareness, reduce incident response time, and support compliance with NIST 800-171, and DoD 8570 requirements.
Key Responsibilities
• Design, develop, and maintain custom Splunk dashboards, alerts, and reports to support both NOC and SOC operations.
• Onboard new data sources including network appliances, servers, security tools, and applications using forwarders, APIs, and syslog integrations.
• Implement data normalization using the Splunk Common Information Model (CIM) to support consistent reporting and event correlation.
• Develop and optimize SPL queries, regex extractions, and macros for high- performing searches and visualizations.
• Configure and tune threshold-based and adaptive alerts for system performance, security, and application availability.
• Collaborate with NOC and SOC analysts to define KPIs and ensure accurate visibility into network health and security posture.
• Support incident detection, triage, and root cause analysis using Splunk dashboards and search tools.
• Monitor and maintain the health and performance of Splunk Enterprise / Splunk Cloud environments.
• Integrate Splunk with automation/orchestration tools (e.g., Ansible, ServiceNow, SOAR platforms) for improved workflow efficiency.
• Document data source onboarding, dashboard configuration, and analytic processes in accordance with program SOPs.
Required Qualifications
• Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, or
related field; equivalent work experience may be substituted.
• 3–5 years of hands-on experience administering, configuring, and developing within Splunk Enterprise or Splunk Cloud environments.
• Active CompTIA Security+, CySA+, CASP+, CISSP, or equivalent DoD 8570 IAT Level II.
• Demonstrated experience designing and maintaining custom dashboards, reports, and alerting frameworks.
• Strong proficiency in Splunk Search Processing Language (SPL), field extractions, and data model creation.
• Familiarity with Linux and Windows server environments, network protocols (TCP/IP, SNMP, syslog), and application log ingestion.
• Understanding of NOC/SOC workflows, event correlation, and log management best practices.
• Experience troubleshooting data ingestion, indexing, and search performance issues.
• Excellent communication, documentation, and collaboration skills.
Preferred Qualifications
• Current Splunk Core Certified Power User, Admin, or Architect certification.
• Experience supporting federal or DoD environments and familiarity with RMF (Risk Management Framework).
• Experience with Python scripting, REST APIs, or JSON/XML parsing for custom integrations.
• Working knowledge of NIST 800-53/171, and log retention / audit evidence requirements.
• Experience with automation, orchestration, or SIEM/SOAR integration.
Key Competencies
• Strong analytical and problem-solving skills.
• Ability to work under pressure in mission-critical environments.
• Detail-oriented with strong organizational skills.
• Self-motivated, adaptable, and able to operate effectively in a team or independently.
• Commitment to continuous improvement and innovation in monitoring and analytics capabilities.
Tools & Technologies
Splunk Enterprise / Cloud, Linux, Windows Server, Cisco and Palo Alto devices, AWS/Azure cloud services, Ansible, ServiceNow, Python, JSON, REST APIs, Syslog, SNMP, SOAR, GitLab CI/CD.
Equal Employment Opportunity
Amatriot and Insperity provide equal employment opportunities to all employees and applicants in all company facilities without regard to race, color, religious creed, sex,
national origin, ancestry, citizenship status, pregnancy, childbirth, (or related medical conditions, including, but not limited to lactation), physical disability, mental and/or intellectual disability, age, military status or status as a Vietnam-era or special disabled veteran, marital status, registered domestic partner or civil union status, gender (including sex stereotyping and gender identity or expression), medical condition (including, but not limited to, cancer related or HIV/AIDS related), genetic information, or sexual orientation in accordance with applicable federal, state and local laws. This applies to all terms and conditions of employment, including, but not limited to, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation and training.
Location: Riverdale, MD (Defense Intelligence Contract) Clearance Requirement: Active TS/SCI Clearance w/ CI Polygraph
Position Overview
The Splunk Engineer supports enterprise-wide monitoring, alerting, and analytics across the customer’s operational and security environments. This position develops and maintains custom Splunk dashboards, visualizations, and alerts that provide actionable insights for NOC and SOC personnel. The engineer ensures data integrity, visibility, and system performance across mission-critical networks and applications supporting government operations. This role bridges IT operations and cybersecurity by delivering analytics solutions that enhance situational awareness, reduce incident response time, and support compliance with NIST 800-171, and DoD 8570 requirements.
Key Responsibilities
• Design, develop, and maintain custom Splunk dashboards, alerts, and reports to support both NOC and SOC operations.
• Onboard new data sources including network appliances, servers, security tools, and applications using forwarders, APIs, and syslog integrations.
• Implement data normalization using the Splunk Common Information Model (CIM) to support consistent reporting and event correlation.
• Develop and optimize SPL queries, regex extractions, and macros for high- performing searches and visualizations.
• Configure and tune threshold-based and adaptive alerts for system performance, security, and application availability.
• Collaborate with NOC and SOC analysts to define KPIs and ensure accurate visibility into network health and security posture.
• Support incident detection, triage, and root cause analysis using Splunk dashboards and search tools.
• Monitor and maintain the health and performance of Splunk Enterprise / Splunk Cloud environments.
• Integrate Splunk with automation/orchestration tools (e.g., Ansible, ServiceNow, SOAR platforms) for improved workflow efficiency.
• Document data source onboarding, dashboard configuration, and analytic processes in accordance with program SOPs.
Required Qualifications
• Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, or
related field; equivalent work experience may be substituted.
• 3–5 years of hands-on experience administering, configuring, and developing within Splunk Enterprise or Splunk Cloud environments.
• Active CompTIA Security+, CySA+, CASP+, CISSP, or equivalent DoD 8570 IAT Level II.
• Demonstrated experience designing and maintaining custom dashboards, reports, and alerting frameworks.
• Strong proficiency in Splunk Search Processing Language (SPL), field extractions, and data model creation.
• Familiarity with Linux and Windows server environments, network protocols (TCP/IP, SNMP, syslog), and application log ingestion.
• Understanding of NOC/SOC workflows, event correlation, and log management best practices.
• Experience troubleshooting data ingestion, indexing, and search performance issues.
• Excellent communication, documentation, and collaboration skills.
Preferred Qualifications
• Current Splunk Core Certified Power User, Admin, or Architect certification.
• Experience supporting federal or DoD environments and familiarity with RMF (Risk Management Framework).
• Experience with Python scripting, REST APIs, or JSON/XML parsing for custom integrations.
• Working knowledge of NIST 800-53/171, and log retention / audit evidence requirements.
• Experience with automation, orchestration, or SIEM/SOAR integration.
Key Competencies
• Strong analytical and problem-solving skills.
• Ability to work under pressure in mission-critical environments.
• Detail-oriented with strong organizational skills.
• Self-motivated, adaptable, and able to operate effectively in a team or independently.
• Commitment to continuous improvement and innovation in monitoring and analytics capabilities.
Tools & Technologies
Splunk Enterprise / Cloud, Linux, Windows Server, Cisco and Palo Alto devices, AWS/Azure cloud services, Ansible, ServiceNow, Python, JSON, REST APIs, Syslog, SNMP, SOAR, GitLab CI/CD.
Equal Employment Opportunity
Amatriot and Insperity provide equal employment opportunities to all employees and applicants in all company facilities without regard to race, color, religious creed, sex,
national origin, ancestry, citizenship status, pregnancy, childbirth, (or related medical conditions, including, but not limited to lactation), physical disability, mental and/or intellectual disability, age, military status or status as a Vietnam-era or special disabled veteran, marital status, registered domestic partner or civil union status, gender (including sex stereotyping and gender identity or expression), medical condition (including, but not limited to, cancer related or HIV/AIDS related), genetic information, or sexual orientation in accordance with applicable federal, state and local laws. This applies to all terms and conditions of employment, including, but not limited to, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation and training.
group id: 90940939
