Splunk Engineer_KPMG

Key Job Requirements

• Design, develop, and maintain detection use cases, correlation rules, and analytics within Splunk Enterprise Security (SIEM).
• Develop and optimise automated response workflows and playbooks using Torq SOAR.
• Create and tune detection content to improve threat visibility and reduce false positives.
• Perform threat hunting and detection engineering activities mapped to the MITRE ATT&CK framework.
• Analyse security events across Windows, Linux, cloud, network, and identity platforms.
• Collaborate with SOC, Incident Response, Threat Intelligence, and Engineering teams to enhance detection and response capabilities.
• Develop dashboards, reports, and metrics to measure detection effectiveness.
• Support security automation, purple team exercises, and continuous improvement initiatives.

Required Qualifications

• 6-8 years of cybersecurity experience, including experience in Detection Engineering, SOC Engineering, Security Monitoring, or Threat Detection.
• Strong hands-on expertise with Splunk Enterprise Security (ES) and Splunk SPL.
• Experience with Torq SOAR or equivalent SOAR platforms.
• Strong understanding of MITRE ATT&CK, threat detection methodologies, and incident response.
• Experience developing correlation rules, risk-based alerting, and threat hunting use cases.
• Knowledge of Windows, Linux, Active Directory, Azure/M365, network, and endpoint security logs.
• Scripting and automation skills using Python, PowerShell, and REST APIs.
• Strong analytical, troubleshooting, and communication skills.

Required Certifications

• Splunk Certified Cybersecurity Defense Engineer.
• Splunk Enterprise Security Certified Admin.
• Splunk SOAR Certified Automation Developer.