Security Information and Event Management (SIEM) Engineer (HYBRID PENNSYLVANIA BASED)

About the position

Forest Pond Associates is seeking a hands-on SIEM Engineer to support the design, configuration, integration, optimization, and ongoing operation of an enterprise security monitoring environment. The contractor will help strengthen security monitoring, threat detection, incident response, and log management capabilities, with a focus on Splunk and related security technologies. This position reports to the client’s Director and provides direct technical support for the SIEM environment. Strategic direction, governance, and overall program oversight remain with the Director.

Responsibilities

Engineer, configure, maintain, and optimize the enterprise SIEM platform, including Splunk and related security technologies.Onboard data sources and ensure logs are collected, parsed, normalized, indexed, and retained appropriately.Develop and maintain correlation searches, alerts, dashboards, reports, detection rules, and other security monitoring content.Integrate SIEM capabilities with security tools, cloud platforms, applications, infrastructure, and other enterprise systems.Monitor platform performance, capacity, availability, and health; troubleshoot technical issues.Tune alerts and detection logic to reduce false positives and improve monitoring effectiveness.Support SOC analysts and incident response personnel with technical expertise, searches, dashboards, and investigative capabilities.Support upgrades, patches, configuration changes, testing, and implementation of supporting SIEM infrastructure.Develop and maintain technical documentation, operational procedures, system configurations, and knowledge-transfer materials.Collaborate with security operations, infrastructure, cloud, networking, and application teams on SIEM-related initiatives.Follow applicable security standards, change-management processes, and cybersecurity policies and requirements.Requirements

Experience engineering, configuring, or administering an enterprise SIEM platform, preferably Splunk.Practical experience onboarding and managing log sources, including parsing, normalization, indexing, and retention.Ability to develop and maintain searches, alerts, dashboards, reports, and security detection content.Experience integrating SIEM platforms with security tools, cloud services, applications, or enterprise infrastructure.Familiarity with SIEM performance monitoring, troubleshooting, upgrades, and configuration management.Understanding of security monitoring, threat detection, SOC workflows, and incident response support.Strong analytical and problem-solving skills, with the ability to investigate technical issues and improve detection quality.Ability to document technical configurations and procedures clearly.Effective communication and collaboration skills for working with technical teams and security operations personnel.Ability to work onsite in Harrisburg, Pennsylvania, three days per week.