Sr Security Engineer with SPLUNK/SIEM

CTC Group, Inc. is seeking a Sr Security Engineer with SPLUNK/SIEM for a contract role based in Harrisburg, PA (hybrid). In this position, you will deliver hands-on technical support for an enterprise SIEM environment built on Splunk, helping power security monitoring, threat detection, incident response, and log management.

This role focuses on SIEM platform design, configuration, integration, optimization, and day-to-day operations, with responsibilities spanning data onboarding, detection engineering, investigation enablement, and maintaining compliant operational procedures.

Key Responsibilities

• Engineer, configure, maintain, and optimize the enterprise SIEM platform, including Splunk and related security tools; execute upgrades, patches, testing, and system changes while maintaining platform health, capacity, and availability.
• Onboard new data sources by parsing, normalizing, indexing, and managing log retention using syslog, APIs, forwarders/agents, and cloud integrations.
• Develop and maintain correlation searches, custom alerts, dashboards, reports, detection rules, and other security monitoring content.
• Fine-tune detection logic and alerts to reduce false positives and resolve complex SIEM, data ingestion, and integration issues.
• Integrate SIEM capabilities with security infrastructure, cloud platforms, networks, and enterprise applications.
• Support SOC analysts and incident response teams with technical expertise, custom Search Processing Language (SPL) queries, dashboards, and investigative assistance.
• Maintain system configurations, operational procedures, and technical documentation; follow change-management workflows, security standards, and policy compliance requirements.

Required Qualifications

• Minimum 3 years of professional IT experience in SIEM, security engineering, SOC operations, or security monitoring technologies.
• Minimum 3 years administering or engineering Splunk Enterprise and/or Splunk Enterprise Security.
• Minimum 3 years onboarding and integrating log sources via syslog, APIs, forwarders/agents, or cloud-native integrations.
• Splunk Enterprise Certified Admin (Required).

Technologies

• Splunk, Splunk Enterprise, Splunk Enterprise Security
• SIEM
• Search Processing Language (SPL)
• syslog, APIs, forwarders/agents
• cloud integrations, cloud-native integrations
• NIST CSF, MITRE ATT&CK

Highly Desired Qualifications

• Experience engineering SIEM solutions within large enterprise or government environments.
• Strong ability to develop complex SPL queries, dashboards, alerts, and correlation searches.
• Hands-on troubleshooting experience for complex logging pipelines and data ingestion failures.
• Familiarity with cybersecurity frameworks including NIST CSF and MITRE ATT&CK.

Pay: USD 120 - 130 per hourly.

Experience: Minimum 3 years.