Senior SIEM Engineer

Job Title: Senior SIEM Engineer

Location: Harrisburg, PA 17120
Work Arrangement: Hybrid Onsite 3 days per week
Interview: In-person
Contract Position

Job Description

We are seeking a Senior SIEM Engineer to provide hands-on engineering support for the Commonwealth's enterprise Security Information and Event Management (SIEM) environment. The ideal candidate will have strong experience with Splunk, security log integration, threat detection, and enterprise security monitoring.

Key Responsibilities

• Configure, maintain, and optimize Splunk and related SIEM technologies.
• Integrate and onboard security log sources from applications, infrastructure, and cloud platforms.
• Develop SPL searches, dashboards, alerts, correlation searches, and reports.
• Monitor SIEM performance, troubleshoot data ingestion issues, and reduce false-positive alerts.
• Support SOC analysts and incident response teams with technical investigations.
• Perform upgrades, patches, testing, and configuration changes.
• Maintain technical documentation and collaborate with security, cloud, networking, and infrastructure teams.
• Follow security policies, standards, and change-management procedures.

Required Qualifications

• 3+ years of experience in SIEM, security engineering, cybersecurity operations, or security monitoring.
• 3+ years of experience administering or engineering Splunk Enterprise and/or Splunk Enterprise Security.
• 3+ years of experience onboarding and integrating security log sources using syslog, APIs, agents, or cloud-native integrations.

Preferred Qualifications

• Splunk Enterprise Certified Admin certification.
• Experience in large enterprise or government environments.
• Strong SPL skills, including searches, dashboards, alerts, and correlation searches.
• Experience troubleshooting SIEM, logging, and data integration issues.
• Familiarity with NIST cybersecurity frameworks and MITRE Telecommunication&CK.

Important Requirements

• Must be available to work onsite in Harrisburg, PA, 3 days per week.
• Must be available for an in-person interview.
• Government equipment must remain within the United States at all times. Taking or using government equipment outside the U.S. is strictly prohibited.
• Candidates must confirm their current location and ability to attend an in-person interview.