SOAR; Phantom Developer

Role

• Develop and maintain playbooks in Splunk SOAR (Phantom).
• Automate SOC workflows and integrate SOAR with IT security systems, ticketing platforms, and threat intelligence feeds.
• Refine and Eeostr, plan, and optimise automation for speed, efficiency, and accuracy.
• Administer and optimise Splunk Enterprise across distributed environments.
• Apply Splunk best practices for indexing, data models, knowledge objects, and search performance.
Հանրապետության<
• Monitor Splunk health, scaling, and redundancy.
• Manage data ingestion pipelines using Cribl for routing, filtering, and transformation.
• Use Redis for caching, enrichment, and high‑speed data lookups in automation workflows.
• Develop SQL‑based integrations for correlation, enrichment, and reporting.
• Ensure seamless integration of APIs, third‑party tools, and security services into Splunk and SOAR.
• Align Splunk and SOAR capabilities with SOC detection and response requirements.
• Apply security and IT architecture patterns – event‑driven workflows, identity management, log aggregation.

• Splunk Enterprise: 5+ years, advanced SPL, indexing, search optimisation, object management.
• Minimum 2 years hands‑on Splunk SOAR (Phantom) development, playbook design and deployment.
• Proficiency in Cribl, Redis, SQL for data ingestion, enrichmentĆ, and correlation.
• Experience integrating with REST APIs, including OAuth and key‑based authentication.
• Strong Python skills – JSON, XML parsing, API requests, regex; familiarity with Power Shell and Bash.
• Solid grasp of cybersecurity fundamentals and SOC operations.
• Unix/Linux administration, networking topology and authentication systems.
• Mapping MITRE ATT&CK tactics and techniques to playbook design.
• Version control experience (Git).
• Splunk Certified Admin and SOAR Developer certifications.
• Nice to have – TAXII, MISP, Recorded Future integration.
• Understanding of data lifecycle, compliance, retention policies, and normalization.
• Experience upgrading Splunk Enterprise, MLTK, UBA, ITSI.
• Familiarity with Dev Ops containers (Docker, Kubernetes) and Zero‑Trust framework.

Mid‑Senior level

Contract

Engineering and Information Technology