View job listingEmployment: W2, full-time and hourly with no benefits package
• Own the on-premises collection tier feeding an enterprise Splunk Cloud environment, covering Cribl Stream worker and leader nodes, Splunk Heavy Forwarders and Universal Forwarders, including patching, upgrades, performance tuning, and role-based access control.
• Build and maintain pipelines that ingest, normalize, parse, and route logs from across the enterprise, filtering low-value data at the pipeline layer to control ingest licensing cost.
• Create customized dashboards in Splunk Enterprise Security that elevate high-threat items to incident responders, and develop ES rules, reports, data monitors, active channels, trends, and use cases that identify threats and optimize data mining across DLA.
• Develop operational dashboards and monitors for pipeline and SIEM ingest health, giving real-time visibility into events per second by log source, Splunk Cloud license utilization, Cribl throughput, and dropped data.
• Work alongside the DLA CERT, who hold primary responsibility for threat detection content, providing specialized routing, masking, and complex parsing for their threat hunting.
• Analyze threat information drawn from logs, intrusion detection systems, intelligence reports and vendor sources, and make recommendations in line with the roles of CERT Incident Handlers and site Information Assurance Managers.
• Develop custom connectors with Python and REST or SOAP integration, so proprietary and non-standard applications without native integrations still deliver usable telemetry.
Computing Environment: Linux+ and Splunk Administrator
DCWF 521 Primary: Cyber Defense Infrastructure Support, Intermediate proficiency. Any of: Security+, CySA+, CEH, SSCP, GSEC, GMON, Cloud+, or PenTest+.
DCWF 451 Primary: System Administrator, Intermediate proficiency. Any of: Security+, Cloud+, GSEC, GICSP, or SSCP. Certifications must align to the assigned work role under DoDM 8140.03.
SEMAIS is an equal opportunity employer. All qualified applicants receive consideration without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.
Apply to Cybersecurity Engineer (Splunk)
Who We Are
Secured Managed Instructional Systems, LLC (SEMAIS) is a Service-Disabled Veteran-Owned Small Business (SDVOSB) that protects mission systems critical to federal agencies. Our leadership brings more than 30 years of combined government experience in cybersecurity, digital modernization, and workforce readiness. Today we focus on exposure management and are developing the next stage of AI governance. We run every engagement with military discipline: we assess the security architecture, detect threats and exposures, and protect mission systems with aligned controls. At SEMAIS, you will join a small team where each person shapes the outcome and builds a career grounded in purpose. Veterans, military spouses, and civilians committed to service will find a strong fit on our team.Status: Contingent upon contract award. These positions support a DLA cybersecurity requirement at DLA Weapons Support and depend on award of the task order to SEMAIS or a teaming prime contractor. We will keep every candidate informed of the award timeline.
Employment: W2, full-time and hourly with no benefits package
Location: On-site at DLA Weapons Support in Columbus, Ohio, or Richmond, Virginia. Alternate worksite only where the Government approves one.
Travel: Up to six round trips per year, roughly four days each to Washington DC, Columbus, OH, and Richmond, VA.
The Role
You will engineer and sustain the log collection and SIEM tier for a DoD logistics enterprise. The work spans the on -premises collection pipeline through Splunk Enterprise Security itself: analyzing threat information from logs, intrusion detection systems, intelligence reports, and vendor sources, then building the dashboards and correlation content that elevate high-threat items to incident responders. Administration of Splunk ES and the backend infrastructure behind it, including upgrades and daily maintenance, is central to the job.Job duties
• Research, plan, install, configure, troubleshoot, maintain, and back up every component of the enterprise log management architecture.• Own the on-premises collection tier feeding an enterprise Splunk Cloud environment, covering Cribl Stream worker and leader nodes, Splunk Heavy Forwarders and Universal Forwarders, including patching, upgrades, performance tuning, and role-based access control.
• Build and maintain pipelines that ingest, normalize, parse, and route logs from across the enterprise, filtering low-value data at the pipeline layer to control ingest licensing cost.
• Create customized dashboards in Splunk Enterprise Security that elevate high-threat items to incident responders, and develop ES rules, reports, data monitors, active channels, trends, and use cases that identify threats and optimize data mining across DLA.
• Develop operational dashboards and monitors for pipeline and SIEM ingest health, giving real-time visibility into events per second by log source, Splunk Cloud license utilization, Cribl throughput, and dropped data.
• Work alongside the DLA CERT, who hold primary responsibility for threat detection content, providing specialized routing, masking, and complex parsing for their threat hunting.
• Analyze threat information drawn from logs, intrusion detection systems, intelligence reports and vendor sources, and make recommendations in line with the roles of CERT Incident Handlers and site Information Assurance Managers.
• Develop custom connectors with Python and REST or SOAP integration, so proprietary and non-standard applications without native integrations still deliver usable telemetry.
Clearance: Active DoD Secret. The position is designated IT I Critical Sensitive, which requires a Tier 5 investigation, formerly SSBI, adjudicated and current at the time of proposal submission. A Top Secret clearance satisfies this and is welcome, but Secret with a current Tier 5 is sufficient.
Experience: Seven years of relevant information technology experience, including integration and sustainment of Splunk Core and Splunk Enterprise Security, and building custom dashboards and reports from threat data.Computing Environment: Linux+ and Splunk Administrator
DCWF 521 Primary: Cyber Defense Infrastructure Support, Intermediate proficiency. Any of: Security+, CySA+, CEH, SSCP, GSEC, GMON, Cloud+, or PenTest+.
DCWF 451 Primary: System Administrator, Intermediate proficiency. Any of: Security+, Cloud+, GSEC, GICSP, or SSCP. Certifications must align to the assigned work role under DoDM 8140.03.
SEMAIS is an equal opportunity employer. All qualified applicants receive consideration without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.