SITEC - SPLUNK SOAR Automation Engineer - MacDill AFB

Peraton requires Automation Engineers to support the Special Operation Command Information Technology Enterprise Contract (SITEC) – 3 EOM.  This position is located at MacDill AFB.

The purpose of the Special Operations Forces Information Technology Enterprise Contract (SITEC) 3 Enterprise Operations and Maintenance (EOM) Task Order (TO) is to provide USSOCOM, its Component Commands, its Theater Special Operations Commands (TSOCs), and its deployed forces with Operations and Maintenance (O&M) services to maintain Network Operations (NetOps); maintain systems and network infrastructure; provide end user and common device support; provide configuration, change, license, and asset management; conduct training, and perform Install, Move, Add, Change (IMACs) services. The responsibilities and tasks associated with each requirement play a pivotal role to USSOCOM, the CIO/J6 organization, and ultimately the end-user who operate around the globe 24x7x365. 

The Automation Engineer will design, build, and maintain automation solutions to support enterprise cyber defense capabilities, with a primary focus on Security Orchestration, Automation, and Response (SOAR) platforms and central telemetry systems such as Splunk and Microsoft Sentinel. This role is essential for minimizing manual, repetitive tasks for Security Operations Center (SOC) analysts, Enterprise Operations Team, accelerating incident response timelines, and ensuring consistent enforcement of security policies. The engineer will leverage scripting and API integrations to connect disparate security tools into a cohesive SIEM/SOAR architecture, enabling seamless data sharing, optimized alert generation, and automated threat mitigation workflows.

• Design, develop, test, and deploy automated workflows, playbooks, and scripts to support cyber incident triage, investigation, and remediation.
• Administer and engineer enterprise SOAR platforms, including architecture planning, system health monitoring, and version upgrades.
• Develop custom API integrations to connect the SOAR platform with a wide array of internal and external security tools, Threat Intelligence Platforms (TIPs), and IT service management systems.
• Collaborate with incident responders, threat hunters, and cyber analysts to gather requirements, map out standard operating procedures (SOPs), and translate them into efficient automated processes.
• Write, maintain, and optimize custom scripts (primarily in Python, PowerShell, or Bash) for parsing data, enriching alerts, and executing response actions.
• Troubleshoot and resolve complex issues related to playbook execution errors, failed API integrations, and data ingestion bottlenecks.
• Work with automations team to develop and deploy cohesive enterprise automation solutions to enhance operational performance.
• Maintain comprehensive documentation for all custom code, automation architecture, and playbook logic.
• Provide technical guidance and training to SOC personnel on utilizing automated workflows effectively.
• Design, deploy, and maintain integrations between SIEM platforms (e.g., Splunk, Microsoft Sentinel) and the enterprise SOAR to establish bi-directional automated alert triage and response capabilities.

Required Qualifications:

• Min 12 years with HS Diploma, 10 years AS/AA degree, 8 years with BS/BA degree, 6 years with MS/MA, 3 with PhD
• A DoW TS/SCI clearance is required
• DoD 8570 IAT II AND

• Must be DoW 8140 compliant under the Work Role Code 451 – System Administrator - Intermediate level or higher by 1 September 26. 

Desired Qualifications:

• Previous experience operating within Department of War (DoW) or DoD enterprise network environments.
• Familiarity with CI/CD pipelines, DevOps practices, and version control systems (e.g., Git) for managing automation code.
• Experience with SIEM engineering, log management, and EDR/XDR technologies (e.g., Splunk Enterprise Security, CrowdStrike).
• Experience with cloud-native automation tools (e.g., AWS Lambda, Azure Logic Apps).