Splunk Engineer in London

This opportunity sits within a fast growing, people first technology organisation that forms part of a global $1B IT and Cyber services provider. They deliver end to end outsourcing and cyber defence solutions across enterprise and public sector clients, with a strong reputation for high quality security delivery.

You will join a well established Security Practice covering MDR, Vulnerability Management, Pen Testing, Incident Response and Security Advisory. This role is focused on leading Splunk engagements across client environments, helping organisations design, build and mature their security monitoring capabilities.

This is a hands on, client facing position where you will own delivery from initial requirements through to implementation, optimisation and continuous improvement.

• You are not just maintaining someone else’s setup. You are shaping how organisations detect and respond to threats from the ground up.
• The work is varied and meaningful. You will be involved in full lifecycle projects, working closely with security teams to build detection capability that actually makes a difference.
• There is real investment in people. You will be surrounded by experienced engineers, with the freedom to develop your skills across areas like detection engineering, threat hunting and security automation.
• You will gain exposure to complex enterprise environments and modern SOC capabilities, putting you in a strong position for future progression into lead or specialist roles.

• Lead end to end Splunk engagements across multiple client environments.
• Design and enhance detection capabilities across Windows and Linux platforms.
• Develop correlation searches, risk based alerting and detection use cases within Splunk Enterprise Security.
• Write and optimise complex queries to support threat detection and threat hunting.
• Map detection logic to MITRE ATT&CK to ensure strong coverage across adversary behaviours.
• Support data onboarding, normalisation and enrichment activities.
• Build dashboards that provide clear, actionable insight for SOC teams.
• Contribute to automation initiatives using Python and PowerShell.
• Collaborate with SOC analysts, incident responders and engineering teams to improve detection and response.
• Provide mentorship and technical guidance to junior engineers.

• Strong hands on experience with Splunk Enterprise Security in a delivery focused role.
• Proven track record delivering cybersecurity or SIEM projects end to end.
• Experience building detection content including correlation rules and alert tuning.
• Strong understanding of threat detection, threat hunting and SOC operations.
• Experience working with frameworks such as MITRE ATT&CK.
• Scripting experience with Python or PowerShell for automation and integration.
• Comfortable working in client facing environments with senior stakeholders.
• Broad knowledge across cybersecurity domains such as IAM and Incident Management.
• Desirable experience includes exposure to SOAR or UEBA technologies and involvement in wider cyber transformation or infrastructure programmes.