OverviewGDC IT Solutions is currently seeking a
SIEM Engineer to support the Commonwealth's enterprise cybersecurity environment. This position focuses on the design, configuration, integration, and optimization of the Security Information and Event Management (SIEM) platform, including Splunk, to strengthen security monitoring, threat detection, incident response, and enterprise log management capabilities.
As a
SIEM Engineer, you will be responsible for engineering, configuring, maintaining, and optimizing the Commonwealth's enterprise SIEM platform and related security technologies. This role provides hands-on technical support for security monitoring, log management, threat detection, and incident response capabilities. Working under the direction of the Director, the SIEM Engineer will collaborate with Security Operations Center (SOC) analysts and infrastructure, cloud, networking, and application teams to enhance detection capabilities, improve platform performance, and support the ongoing operation of the SIEM environment.
Responsibilities- Engineer, configure, maintain, and optimize the enterprise SIEM platform, including Splunk and related security technologies.
- Onboard new data sources and ensure logs are properly collected, parsed, normalized, indexed, and retained.
- Develop and maintain correlation searches, alerts, dashboards, reports, detection rules, and other security monitoring content.
- Integrate SIEM capabilities with security tools, cloud platforms, applications, infrastructure, and other enterprise systems.
- Monitor SIEM platform performance, capacity, availability, and overall health, and troubleshoot technical issues.
- Tune alerts and detection logic to reduce false positives and improve the effectiveness of security monitoring.
- Support SOC analysts and incident response personnel by providing technical expertise, queries, dashboards, and investigative capabilities.
- Support SIEM platform upgrades, patches, configuration changes, testing, and implementation of supporting infrastructure.
- Develop and maintain technical documentation, operational procedures, system configurations, and knowledge-transfer materials.
- Collaborate with SOC, infrastructure, cloud, networking, and application teams on SIEM-related initiatives.
- Follow Commonwealth security standards, change-management processes, and applicable cybersecurity policies and requirements.
Minimum Qualifications- Hands-on experience engineering, configuring, maintaining, and optimizing SIEM platforms, including Splunk.
- Experience with security log collection, data source onboarding, parsing, normalization, indexing, and retention.
- Experience developing and maintaining security alerts, correlation searches, detection rules, dashboards, and reports.
- Experience troubleshooting security monitoring platforms and supporting enterprise security operations.
- Knowledge of cybersecurity principles, threat detection, security monitoring, and incident response processes.
- Experience integrating security technologies with enterprise infrastructure, applications, and cloud platforms.
- Ability to develop technical documentation, operational procedures, and system configuration records.
- Ability to collaborate with security, infrastructure, networking, cloud, and application teams.
- Experience supporting enterprise-scale Splunk deployments and related security technologies.
- Experience tuning SIEM detection logic and reducing false positives to improve threat detection effectiveness.
- Experience supporting SOC operations, security investigations, and incident response activities.
- Experience with SIEM platform performance monitoring, capacity planning, upgrades, patching, and ongoing optimization.
- Experience integrating SIEM solutions with cloud security services and diverse enterprise technology environments.
- Familiarity with Commonwealth security standards, formal change-management processes, and enterprise cybersecurity policies.
