Splunk SME

Role:
Splunk SOAR & Splunk Engineer/ SME

Location: Baltimore, MD

Key Responsibilities

• Design, develop, and maintain automated playbooks using Splunk SOAR (Phantom) to streamline SOC workflows.
• Integrate SOAR with security tools, IT systems, ticketing platforms, and threat intelligence feeds.
• Administer and optimize Splunk Enterprise in distributed, high-ingest environments.
• Implement Splunk best practices for indexing, data models, SPL optimization, and knowledge objects.
• Manage data ingestion and routing using Cribl
  , and leverage Redis for caching and enrichment.
• Develop SQL-based integrations for data correlation, enrichment, and reporting.
• Collaborate with SOC and IT teams to align automation with detection and response strategies.
• Monitor Splunk platform health, scalability, and redundancy.

Essential Skills

• 5+ years of hands‑on experience with Splunk Enterprise
  , including multi‑TB daily ingest environments.
• 2+ years of Splunk SOAR (Phantom) playbook design and development experience.
• Advanced SPL knowledge, search optimization, and object management.
• Strong experience with Cribl, Redis, and SQL for data ingestion, enrichment, and correlation.
• Proficiency in Python (JSON/XML parsing, API integrations, regex); familiarity with Power Shell and Bash
  .
• Experience integrating REST APIs with OAuth and key-based authentication.
• Solid understanding of SOC operations
  , cybersecurity fundamentals, and MITRE ATT&CK framework.
• Strong knowledge of Linux/Unix administration
  , networking concepts, and authentication systems.
• Experience with Git/version control systems
  .
• Splunk Certified Admin and Splunk SOAR Developer certifications.

Nice-to-Have Skills

• Threat intelligence integrations (TAXII, MISP, Recorded Future).
• Experience with Splunk upgrades and platform migrations.
• Knowledge of Splunk MLTK, UBA, ITSI
  .
• Understanding of data lifecycle management (compliance, retention, normalization).
• Familiarity with Docker, Kubernetes
  , and Dev Ops practices.
• Knowledge of Zero Trust security architecture.

Experience Required

• 10+ years overall IT/Security experience.