Splunk Architect / Subject Matter Expert (SME)
ECS is seeking a Splunk Architect / Subject Matter Expert (SME) to work remotely. Please Note: This position is contingent upon contract award.
ECS Federal is seeking an experienced Splunk Architect to design, build, and optimize an integrated Splunk SOAR + UBA + Core environment with automated compliance via Qmulos Q‑Compliance/Q‑Audit for a long‑term Federal program. You will lead hybrid (remote‑first) engineering efforts that advance the client toward OMB M‑21‑31 Event Logging Level 3 while mapping evidence to NIST 800‑53, FISMA, and NERC CIP.
Position Responsibilities:
- Architect & Engineer Splunk Core, SOAR, and UBA tiers; develop data‑ingest blueprints and high‑level architecture.
- Automate Compliance using Q‑Compliance/Q‑Audit to map controls and produce real‑time dashboards.
- Develop SOAR Playbooks & UBA Models for privileged‑account misuse, lateral movement, and OT/IT segmentation alerts.
- Integrate OT Log Sources via secure one‑way transfers and document risk mitigations.
- Lead Workshops & Knowledge Transfer sessions; create Section 508‑compliant diagrams and runbooks.
- Mentor BPA analysts and junior engineers on Splunk best practices and compliance automation.
Salary Range: $150,000 - $190,000
General Description of Benefits
Qualifications- Hands‑on Experience
- 3 + years architecting Splunk Enterprise / Splunk SOAR (Phantom) solutions in federal or critical‑infrastructure settings
- 2 + years deploying Splunk UBA and Qmulos Q‑Compliance/Q‑Audit, including control mapping to NIST/FedRAMP
- Proven ability to automate compliance evidence for OMB M‑21‑31, NIST RMF, and EO 14028 objectives.
- Strong stakeholder‑engagement, documentation, and briefing skills suitable for C‑suite and COR audiences.
Clearance Requirement:
U.S. citizenship and eligibility to obtain a DOE public‑trust (Q level) clearance; sponsorship provided
Certifications / Licenses:
- Bachelor’s degree in Computer Science, Cybersecurity, Engineering, or related discipline (or equivalent experience).
- Active Splunk certifications: Splunk Core Certified Admin and Splunk SOAR Certified Automation Developer
- Preferred: Splunk Certified Architect, CISSP, CISM, or Qmulos Certified Professional.
Originally posted on Himalayas
Apply To this Job