Data Capital

Cybersecurity Engineer – Splunk SIEM

Location: Richmond, VA Metro Area | Hybrid
Type: Contract | Client: Virginia Government Agency

Job Summary

Seeking an experienced Cybersecurity Engineer with strong Splunk SIEM / Splunk Enterprise Security expertise to support security monitoring, threat detection, threat hunting, and incident response.

Key Responsibilities

• Monitor and investigate security events using Splunk Enterprise Security.

• Develop and tune SPL queries, correlation searches, alerts, dashboards, and reports.

• Perform threat hunting and security incident investigations.

• Onboard and troubleshoot security log sources and data ingestion.

• Develop security detection use cases aligned with MITRE ATT&CK.

• Analyze endpoint, network, server, application, and cloud logs.

• Reduce false positives and improve detection capabilities.

• Collaborate with infrastructure, network, cloud, and security teams.

• Support incident response, security audits, and documentation.

Required Skills

• 5+ years of Cybersecurity/SIEM/Security Operations experience.

• Strong hands-on Splunk ES and SPL experience.

• Experience with correlation searches, dashboards, alerts, and threat hunting.

• Strong log analysis and incident response skills.

• Knowledge of MITRE ATT&CK, NIST, and security detection techniques.

• Experience with log ingestion, parsing, field extraction, and normalization.

• Understanding of network, endpoint, Windows/Linux, and cloud security logs.

Preferred

• Splunk certifications.

• Experience with SOAR, EDR/XDR, and cloud security.

• Knowledge of Azure/AWS/Google Cloud Platform.

• Certifications such as CISSP, Security+, CySA+, IH.

Must Have: Splunk SIEM/ES + SPL + Threat Hunting + Incident Response.