Support incident response with threat context, attribution analysis, and indicator enrichment.
Detection engineering
Design, build, test, and tune detections in Splunk Enterprise Security, including correlation searches, risk-based alerting (RBA) rules, and notable event logic.
Translate intelligence on adversary TTPs into detection coverage; maintain a coverage map against MITRE ATT&CK and identify gaps.
Write efficient, maintainable SPL; build and maintain lookups, macros, data models, and CIM-compliant normalization for new data sources.
Own the detection lifecycle: hypothesis, development, validation against test data or purple-team exercises, deployment, tuning, and retirement.
Reduce false positives and alert fatigue through measurement and iterative tuning.
Threat hunting and exposure management
Conduct hypothesis-driven threat hunts across Splunk and endpoint, network, identity, and cloud telemetry.
Correlate vulnerability data (Tenable) with endpoint (SentinelOne), source control (GitHub), network and edge (F5, Check Point, Zscaler), and email (Proofpoint) telemetry to surface exposed, exploitable, and actively targeted assets.
Contribute to the continuous threat exposure management (CTEM) program by aligning threat intelligence with asset context and business impact.
Support emerging programs in AI security, supply chain / third-party risk, and application security with threat research and detection use cases.
Reporting and collaboration
Build and maintain Splunk dashboards and scheduled reports for threat intelligence metrics, detection coverage, and hunt outcomes.
Partner with the Splunk platform team on data onboarding, search performance, and platform changes.
Work closely with vulnerability management, incident response, IT operations, and application owners to drive remediation and detection improvements.
Brief technical and non-technical audiences, including contributions to CISO and governance-level reporting.
What you bring
Required
4+ years in cybersecurity with at least 2 years focused on threat intelligence, detection engineering, threat hunting, or SOC analysis.
Strong hands-on Splunk experience: advanced SPL, Splunk Enterprise Security, correlation searches, risk-based alerting, data models, and CIM.
Demonstrated experience building and tuning detections from threat intelligence or adversary emulation.
Working knowledge of MITRE ATT&CK and the ability to apply it to both intelligence analysis and detection coverage.
Solid understanding of attacker tradecraft across endpoint, network, identity, cloud, and email.
Familiarity with vulnerability management data and prioritization frameworks (CVSS, VPR, EPSS, CISA KEV).
Strong analytical writing; able to produce concise intelligence products for audiences ranging from engineers to executives.
Preferred
Experience with Tenable, SentinelOne, GitHub Advanced Security, Zscaler, Proofpoint, or comparable platforms.
Scripting in Python for enrichment, automation, or data analysis; familiarity with APIs and STIX/TAXII.
Experience with a threat intelligence platform (TIP) and with structured analytic techniques.
Exposure to CTEM or exposure management platforms.
Experience with detection-as-code practices (version control, testing, CI/CD for detections).
Relevant certifications such as GCTI, GCDA, GCFA, Splunk Core Certified Power User or Enterprise Security Certified Admin, or CySA+.
Background in AI/ML security, software supply chain security, or application security.
SECU provides equal employment opportunity to all qualified persons regardless of race, color, religion, age, sex, sexual orientation, gender identity, national origin, genetic information, disability, veteran status, or other classification protected by law.
Disclaimer
State Employees' Credit Union reserves the right to fill this role at a higher/lower level based on business need.
