SIEM Subject Matter Expert (Splunk)

A Splunk Enterprise Security subject matter expert at Accenture Federal Services in Washington, DC, responsible for a large Splunk deployment that takes in logs from a very large endpoint estate for a federal SOC. The expert owns its architecture, sizing and health, writes and tunes correlation rules mapped to MITRE ATT&CK, onboards and normalises new log sources, builds SIEM-to-SOAR integrations for automated enrichment and response, handles upgrades and capacity planning, troubleshoots performance and data quality, and trains SOC analysts.

It asks for five years of SIEM architecture and engineering at scale, deep SPL and data onboarding knowledge, SOAR integration experience, and the Splunk Certified Architect certification.