Splunk Consultant – Detection Developer

About the role

Sopra Steria is looking for a solution-oriented Splunk consultant in Oslo to work on its platform, monitoring and security side of Splunk. As a detection developer you will help uncover cyberattacks and strengthen customers' security monitoring by building robust, insight-driven solutions.

Key responsibilities

• Develop and improve security detections in SIEM platforms such as Splunk Enterprise Security, based on logs, attack scenarios and knowledge of customers' systems.
• With security staff, system owners and technical experts map detection coverage, identify security gaps and build detections with high security value.
• Maintain well-documented detections that can be handled effectively during an incident.

Required profile

• Experience developing, testing and tuning security detections.
• Ability to map detection coverage and security gaps, and to understand attacker methods and attack scenarios.
• Knowledge of MITRE ATT&CK or similar frameworks and of incident handling.
• Advantageous: Splunk certifications, cloud-based solution experience (AWS, Azure, GCP) and knowledge of other SIEM tools.

Required skills

• Splunk Enterprise Security or similar SIEM platforms (e.g. Microsoft Sentinel).
• SPL, KQL or similar query languages.
• Understanding of logs from Windows EventLog, Sysmon, EDR, firewalls, IDS/IPS, networks, clouds and databases, including log normalization.

What we offer

• Insurance and pension arrangements with private health insurance, full pay during parental leave, six weeks holiday and access to company facilities.
• Support for certifications and a broad range of projects across industries.
• 30 voluntary activity groups and a reputation as one of Norway's best workplaces.