Apply on Employer Site

Deloitte · 2 months ago

Splunk Content Developer – (IoT/OT Focus)

Arlington/Rosslyn, Virginia, United States

Full-time

Hybrid

Senior Level

5+ years exp

Deloitte is a leading professional services firm that specializes in cybersecurity solutions. The Splunk Content Developer will focus on developing and optimizing Splunk correlation searches and dashboards to identify cybersecurity threats across IT, IoT, and OT environments, while also creating automation workflows to support SOC analysts in incident response.

AccountingConsultingFinancial ServicesLegalProfessional ServicesRisk Management

Growth Opportunities

No H1B

Security Clearance Required

U.S. Citizen Only

Responsibilities

Develop and optimize Splunk correlation searches, dashboards, and alerts to identify cybersecurity threats and suspicious activity across IT, IoT, and OT device environments

Create automation workflows, investigative queries, and playbooks to support SOC analysts in efficient incident triage, investigation, and response, with special attention to the unique protocols and behaviors of IoT/OT devices

Collaborate with SOC teams to minimize false positives, improve alert quality, and ensure detection content is aligned with both IT and OT/IOT security priorities and emerging threat landscapes

Qualification

Splunk correlation rulesIoT/OT experienceSplunk event correlationTuning Splunk rulesCreating Splunk reportsSplunk technologiesBachelor's degree

Required

Bachelor's degree

Must be legally authorized to work in the United States without the need for employer sponsorship, now or at any time in the future

Active Secret security clearance required

Ability to travel 15%, on average, based on the work you do and the clients and industries/sectors you serve

Ability to be onsite up to three days a week

At least 5 years experience in the following:

Experience in developing, implementing, and managing Splunk correlation rules and content

IoT/OT experience and knowledge

Demonstrated ability to build and implement event correlation rules, logic, and content in Splunk, with specific, hands-on experience in Splunk environments

Experience tuning Splunk event correlation rules and logic to filter out security events associated with known network behavior, false positives, and/or known errors

Proven experience maintaining an event schema in Splunk with customized security severity criteria

Experience creating both scheduled and ad-hoc reports in Splunk

Thorough and in-depth understanding of Splunk technologies and event collector deployments in both Windows and Linux operating environments