Security Engineer III, Splunk Architect

Deloitte is seeking a Security Engineer III, Splunk Architect to design, implement, and optimize Splunk solutions for security monitoring, visibility, and enterprise logging strategies. The role blends hands-on engineering with architecture responsibilities to support threat detection, incident response, and compliance monitoring.

Responsibilities

• Design, implement, and optimize Splunk architectures to enable security monitoring, log management, and operational analytics.
• Develop and maintain Splunk dashboards, alerts, reports, searches, and data models aligned to client and business requirements.
• Integrate data sources into Splunk, including infrastructure, cloud, application, and security technologies.
• Support development of use cases for threat detection, incident response, compliance monitoring, and operational visibility.
• Create and maintain architecture diagrams, technical documentation, implementation standards, and administration procedures.

Required Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical field.
• Active Top-Secret Clearance.
• Ability to work onsite up to 5 days a week in Arlington, VA.
• 2+ years of experience implementing and supporting Splunk Enterprise or Splunk Cloud.
• 2+ years developing Splunk dashboards, reports, alerts, and saved searches.
• 2+ years onboarding and normalizing log sources from infrastructure, applications, cloud platforms, or security tools.
• 2+ years with SIEM concepts, security monitoring, or threat detection use cases.
• Working knowledge of Transmission Control Protocol/Internet Protocol (TCP/IP), networking protocols, and system log analysis.
• Experience with Splunk Search Processing Language (SPL), data models, and role-based access controls.
• One or more certifications: Splunk Core Certified Power User, Splunk Enterprise Certified Admin, or Splunk Enterprise Security certification.
• Ability to travel 20% on average based on client and industry needs.
• Legally authorized to work in the United States without employer sponsorship, now or in the future.

Technologies

• Splunk Enterprise, Splunk Cloud
• Splunk Search Processing Language (SPL)
• Splunk dashboards, Splunk data models
• Transmission Control Protocol/Internet Protocol (TCP/IP)
• SIEM
• Python
• AWS, Microsoft Azure, Google Cloud Platform (GCP)
• Splunk Enterprise Security, Splunk SOAR

Preferred Qualifications

• 1+ year supporting Splunk in AWS, Microsoft Azure, or GCP.
• 5+ years with Splunk Enterprise Security, Splunk SOAR, or security orchestration workflows.
• 5+ years integrating Splunk with endpoint, identity, firewall, or cloud security tools.
• 1+ year with Python, automation scripting, or infrastructure as code tools.
• Experience supporting regulated or federal environments.

Additional Skills

• Ability to work independently and collaborate as part of a team.
• Effective written and verbal communication skills.
• Meticulous attention to detail and quality of work product.
• Ability to build and sustain professional relationships.
• Ability to lead projects or workstreams.
• Ability to manage and prioritize multiple tasks in a fast-paced and dynamic environment.
• Strong interpersonal skills and professional demeanor.
• Ability to meet deadlines and provide clear guidance to others.

Team Overview

• Deloitte’s Deloitte Cyber team understands the unique challenges and opportunities businesses face in cybersecurity.
• The Cyber Defense & Resilience offering helps clients defend against advanced threats by transforming security operations, monitoring technology, data analytics, and threat intelligence.
• The team supports managing and protecting dynamic attack surfaces and enables rapid crisis and cyber incident response so clients can be ready for, respond to, and recover from business disruptions.

Location and Salary

Location: Arlington, VA (onsite)

Compensation: USD 102,500 - 188,900 per yearly

Experience Level: 2+ years