Description
This role works within Splunk’s internal security organization as a member of the Detection Engineering team responsible for securing the Splunk portfolio.
You will partner fluidly with our multi-functional peer teams: Threat Hunting & Intelligence, SOC, Advanced Response, and others, to ensure that Splunk is always prepared for emergent threats.
As a Detection Engineer, you will design and build data processing pipelines that efficiently transform high-volume security telemetry into actionable alert signals for downstream agentic and human triage.
You will also drive complex, cross-organizational initiatives with business partners to continuously expand visibility and close detection gaps.
The successful applicant will be performing work in FedRAMP High or IL-5 environments, and therefore, must be a U.S. Person (i.e. U.S. citizen, U.S. national, lawful permanent resident, asylee, or refugee).
Minimum Qualifications:
- Bachelor’s + 8 years of related experience or a Master’s degree with 6+ years of related experience, or a PhD + 3 years of related experience as a Security Engineer, Detection Engineer, Security Content Developer, SOC Analyst, or Security Operations professional
- Deployed and maintained Splunk Enterprise Security content in a production SOC environment, including detections, data models, and data management
- Built detection queries in SPL at scale, including risk-based alerting, statistical baselining, and optimized searches across high-volume data sources
- Integrated AI/ML techniques (e.g., anomaly detection, LLM-assisted workflows) into detection engineering pipelines to reduce false positive rates and accelerate content development
- Translated threat intelligence and ATT&CK-mapped adversary behaviors into detection requirements with defined coverage metrics and measurable success criteria
Preferred Qualifications:
- Contributed to collaborative development workflows using Git-based platforms (GitHub, GitLab, or Bitbucket), including branch strategy, code review, and CI/CD integration
- Built or tuned security monitoring coverage across AWS, GCP, or Azure, including native logging services (e.g., CloudTrail, GCS audit logs, Azure Monitor) and cloud-native threat detection
- Tracked and responded to emerging threats and attacker techniques through ongoing research, published work, conference participation, or contributions to detection content
- Wrote production Python (or equivalent) with unit tests, code reviews, and version-controlled deployments in an operational security environment
- Applied statistical methods or ML techniques (e.g., threshold baselining, clustering, anomaly scoring) to security data to improve detection signal quality
- Identified and delivered automation that measurably reduced manual toil or cycle time in detection, triage, or response workflows
- Produced technical documentation, runbooks, or presentations tailored to both engineering and non-technical security stakeholders
- Partnered with SOC, IR, threat intel, and product teams to drive multi-functional detection initiatives from requirement to deployment
Benefits:
- Medical, dental and vision insurance
- 401(k) plan with a Cisco matching contribution
- Paid parental leave
- Short and long-term disability coverage
- Basic life insurance
- 10 paid holidays per full calendar year, plus 1 floating holiday for non-exempt employees
- 1 paid day off for employee’s birthday, paid year-end holiday shutdown, and 4 paid days off for personal wellness
- Non-exempt employees receive 16 days of paid vacation time per full calendar year
- Exempt employees participate in Cisco’s flexible vacation time off program
- 80 hours of sick time off provided on hire date and each January 1st thereafter
- Optional 10 paid days per full calendar year to volunteer