Job Description: SIEM Engineer

Job Title: SIEM Engineer
Work Location: Keystone Building, 5th Floor, Harrisburg, PA 17120
Work Arrangement: Hybrid – 3 days onsite per week
Interview Process: In-person interview
Contract Type: Contract
Visa Requirements: All work authorizations accepted except EAD/OPT
C2C: Accepted

Job Overview

We are seeking an experienced SIEM Engineer to provide hands-on engineering support for its enterprise Security Information and Event Management (SIEM) environment.

The selected candidate will be responsible for designing, configuring, integrating, maintaining, and optimizing SIEM capabilities to strengthen security monitoring, threat detection, incident response, and enterprise log management.

This is a hands-on technical engineering position reporting to the Director. Strategic direction, governance, and overall program oversight will be managed by the Director.

Key Responsibilities

• Engineer, configure, maintain, and optimize the enterprise SIEM platform, primarily Splunk and related security technologies.

• Onboard new data sources and manage log collection, parsing, normalization, indexing, and retention.

• Develop and maintain correlation searches, detection rules, alerts, dashboards, reports, and security monitoring content.

• Integrate SIEM solutions with cloud platforms, enterprise applications, infrastructure, and security tools.

• Monitor SIEM platform performance, capacity, availability, and overall system health.

• Troubleshoot technical issues and optimize platform performance and reliability.

• Tune alerts and detection logic to reduce false positives and improve threat detection effectiveness.

• Support SOC analysts and incident response teams with queries, dashboards, and investigation capabilities.

• Support SIEM upgrades, patches, configuration changes, testing, and infrastructure implementation.

• Maintain technical documentation, system configurations, operational procedures, and knowledge-transfer materials.

• Collaborate with SOC, infrastructure, cloud, networking, and application teams.

• Follow Commonwealth security standards, change-management procedures, and applicable cybersecurity policies.

Required Skills and Experience

• Strong hands-on experience with Splunk and enterprise SIEM engineering.

• Experience with log ingestion, parsing, normalization, indexing, and retention.

• Proficiency in developing correlation searches, alerts, detection rules, dashboards, and reports.

• Experience integrating SIEM platforms with cloud environments, infrastructure, applications, and security technologies.

• Strong troubleshooting, performance optimization, and alert-tuning capabilities.

• Experience supporting Security Operations Center (SOC) operations, threat detection, and incident response.

• Knowledge of security event analysis, log management, and security monitoring best practices.

• Strong technical documentation, problem-solving, and cross-functional communication skills.

Ideal Candidate Profile

The ideal candidate is a hands-on SIEM Engineer with strong Splunk expertise and experience managing enterprise-scale security monitoring environments. The candidate should be capable of independently handling SIEM configuration, data-source onboarding, detection engineering, troubleshooting, and performance optimization while collaborating with SOC and infrastructure teams.

Candidates with direct experience in Splunk engineering, enterprise log management, detection content development, and production SIEM operations should be prioritized.

Work Arrangement and Interview Requirements

• Must be willing to work onsite at the Keystone Building in Harrisburg, Pennsylvania, three days per week.

• Must be available for an in-person interview.

• Candidates must confirm their work authorization and willingness to meet the onsite requirement before submission.

• EAD/OPT work authorizations are not accepted.

• C2C submissions are accepted.