Forest Pond Associates, Inc. Security Information and Event Management (SIEM) Engineer (HYBRID PENNSYLVANIA BASED) Harrisburg, PA · Contractor Company website

Apply for Security Information and Event Management (SIEM) Engineer (HYBRID PENNSYLVANIA BASED)

Forest Pond Associates is a consulting firm that provides technology, data, and operational support to government and life sciences organizations. We help clients address complex challenges through practical expertise, thoughtful collaboration, and hands-on delivery. Our work includes supporting secure, reliable systems and helping teams strengthen the processes and capabilities they depend on.

Security Information and Event Management (SIEM) Engineer

About Forest Pond Associates

Forest Pond Associates is a remote first consulting firm headquartered in Pennsylvania that provides technology, data, and operational support to government and life sciences organizations. We help clients address complex challenges through practical expertise, thoughtful collaboration, and hands-on delivery. Our work includes supporting secure, reliable systems and helping teams strengthen the processes and capabilities they depend on.

Position Overview

Forest Pond Associates is seeking a hands-on SIEM Engineer to support the design, configuration, integration, optimization, and ongoing operation of an enterprise security monitoring environment. The contractor will help strengthen security monitoring, threat detection, incident response, and log management capabilities, with a focus on Splunk and related security technologies.

This position reports to the client’s Director and provides direct technical support for the SIEM environment. Strategic direction, governance, and overall program oversight remain with the Director.

Responsibilities

- Engineer, configure, maintain, and optimize the enterprise SIEM platform, including Splunk and related security technologies.

- Onboard data sources and ensure logs are collected, parsed, normalized, indexed, and retained appropriately.

- Develop and maintain correlation searches, alerts, dashboards, reports, detection rules, and other security monitoring content.

- Integrate SIEM capabilities with security tools, cloud platforms, applications, infrastructure, and other enterprise systems.

- Monitor platform performance, capacity, availability, and health; troubleshoot technical issues.

- Tune alerts and detection logic to reduce false positives and improve monitoring effectiveness.

- Support SOC analysts and incident response personnel with technical expertise, searches, dashboards, and investigative capabilities.

- Support upgrades, patches, configuration changes, testing, and implementation of supporting SIEM infrastructure.

- Develop and maintain technical documentation, operational procedures, system configurations, and knowledge-transfer materials.

- Collaborate with security operations, infrastructure, cloud, networking, and application teams on SIEM-related initiatives.

- Follow applicable security standards, change-management processes, and cybersecurity policies and requirements.

Qualifications

- Experience engineering, configuring, or administering an enterprise SIEM platform, preferably Splunk.

- Practical experience onboarding and managing log sources, including parsing, normalization, indexing, and retention.

- Ability to develop and maintain searches, alerts, dashboards, reports, and security detection content.

- Experience integrating SIEM platforms with security tools, cloud services, applications, or enterprise infrastructure.

- Familiarity with SIEM performance monitoring, troubleshooting, upgrades, and configuration management.

- Understanding of security monitoring, threat detection, SOC workflows, and incident response support.

- Strong analytical and problem-solving skills, with the ability to investigate technical issues and improve detection quality.

- Ability to document technical configurations and procedures clearly.

- Effective communication and collaboration skills for working with technical teams and security operations personnel.

- Ability to work onsite in Harrisburg, Pennsylvania, three days per week.

Work Arrangement

Hybrid, with three onsite days per week in Harrisburg, Pennsylvania.

Interview Format

In person.We are seeking a hands-on SIEM Engineer to support the design, configuration, integration, optimization, and ongoing operation of an enterprise security monitoring environment. The contractor will help strengthen security monitoring, threat detection, incident response, and log management capabilities, with a focus on Splunk and related security technologies.

Responsibilities include onboarding and maintaining log sources; developing and tuning searches, alerts, dashboards, reports, and detection rules; integrating the SIEM platform with enterprise, cloud, and security systems; and monitoring platform performance, availability, and capacity. The contractor will troubleshoot technical issues, support upgrades and configuration changes, and provide SOC analysts and incident response personnel with technical expertise and investigative tools.

The role will also maintain system documentation and operational procedures and coordinate with security operations, infrastructure, cloud, networking, and application teams. The contractor will follow applicable security standards, cybersecurity policies, and change-management processes. Strategic direction, governance, and overall program oversight remain with the organization’s director.

Work arrangement: Hybrid, with three onsite days per week in Harrisburg, Pennsylvania.

Interview format: In person.