Overview In this role you will administer and optimize Splunk Enterprise and Enterprise Security to support NAVINTEL SIEM operations in Suitland, MD. You will onboard data sources, maintain CIM compliance, and develop dashboards and detection content to aid incident response and threat hunting. You will produce operational reports and documentation, ensuring quality data parsing and normalization. This position focuses on enabling effective SOC workflows and security monitoring within a mission-driven environment.
Responsibilities- Administer Splunk Enterprise and Enterprise Security, CIM compliance, correlation searches, RBAs, dashboards, and data models
- Onboard new data sources, ensure quality parsing and normalization
- Support incident response, threat hunting, detection engineering, and content governance
- Produce operational reports, posture summaries, dashboards, and detection documentation
Key requirements- Bachelor in CS/IT/IA or related area with 8+ years of experience or Master with 6+ years
- Active TS/SCI security clearance
- Experience supporting Computer Network Defense (CND) operations and technologies
- 6+ years of professional Splunk experience and related components (Add-ons/Apps, Splunk TA, Universal Forwarder)
- Deep experience with Splunk Enterprise/ES, SPL, CIM mapping, dashboards, and Linux administration
- Experience supporting SOC workflows and SIEM tuning
- DoD 8570 CSSP Infrastructure Support certification (e.g., CEH, CySA+, CASP+, CISSP)
- Splunk Enterprise
- Splunk Enterprise Security
- SPL (Search Processing Language)
- CIM mapping
- Dashboards and data models
- Linux administration
