Fedramp Software Engineer – Early Career

Sword achieves Splunk Advise Motion Elite status. Elizabeth Greenberg 24 July 2026, 10.55am "Being the first regional Splunk partner in the UK and Ireland to achieve Elite status is a fantastic achievement for Sword," Kevin Moreton, CEO of Sword UK, said. Sword has become the first regional Splunk partner in the UK and Ireland to achieve Elite status within the Splunk Advise Motion programme, recognising the company's proven consulting expertise, technical capability and track record of delivering successful customer outcomes. The achievement represents the highest level of accreditation within Splunk's Advise Motion programme and places Sword among a select group of partners recognised for their ability to help organisations maximise value from their data through advisory, consulting and professional services. Elite status is awarded to partners that can demonstrate deep technical expertise, accredited skills, established consulting practices and verified industry experience. The recognition reflects Sword's continued investment in developing specialist capabilities, supporting professional development and accreditations, and building a mature consulting practice that delivers measurable outcomes for customers. Sword works with organisations in highly regulated operations across critical national infrastructure including major energy and financial services providers. Through its partnership with Splunk, the company helps customers improve operational resilience, strengthen security, increase visibility across IT and operational technology environments, and make informed, risk-based decisions. Kevin Moreton, CEO of Sword UK, said: "Being the first regional Splunk partner in the UK and Ireland to achieve Elite status is a fantastic achievement for Sword. "It reflects the expertise of our people, the strength of our partnership with Splunk, and our commitment to delivering meaningful outcomes for customers operating in some of the most demanding and highly regulated environments." Recommended reading. Alexandra Turbitt, GVP, Partner Organisation and Digital Sales, EMEA, Splunk, shared: "Achieving Elite status further strengthens Sword's partnership with Splunk, a Cisco Company, and reinforces the company's commitment to helping organisations address complex operational, security and data challenges through a combination of technical expertise, industry experience and advisory-led services." Those interested in exploring these challenges further can register for Sword's upcoming webinar, Building Resilience Through Observability, taking place on 29 July at 1pm, where experts will discuss how real-time observability can help organisations strengthen resilience, support regulatory compliance and improve decision-making across complex IT and OT environments. Registration is available at Register for the webinar.

Exabeam vs. Splunk: which approach improves security operations outcomes? * Jul 23, 2026 * Heidi Willbanks * 3 minutes to read Table of Contents Not every SIEM solution is built for modern security operations. While Splunk is widely used for log management, many teams face unpredictable pricing, complex tuning, and slow investigations as environments scale. New-Scale Fusion takes a different approach, It combines behavioral analytics, dynamic risk scoring, and coordinated AI agents to help teams detect risk earlier and move investigations forward faster. Here are six ways Exabeam improves outcomes compared to Splunk. 1. Predictable costs and clear value. Splunk cloud workload pricing model is complex and often unpredictable. Costs scale based on ingestion, storage, compute, and add-ons, which can lead to overages and rising spend as environments grow. Exabeam includes analytics, automation, and threat intelligence within New-Scale Fusion. As data volume increases, you gain more detection coverage and automation without layering on additional modules. Outcome: More predictable cost structure with increasing value over time. 2. Less tuning and operational overhead. Splunk requires continuous tuning. Analysts must maintain Splunk Search Processing Language (SPL) queries, build correlations, and reduce false positives through manual adjustments. Behavioral analytics capabilities are bundled into higher-tier offerings, increasing cost and complexity. Migration paths between legacy and newer capabilities can introduce additional operational risk. Exabeam reduces this overhead with: * Prebuilt detection coverage * Behavioral analytics for users, entities, and agents * Contextual correlation and automated workflows Analysts move from detection to investigation in a single interface without custom scripting. Outcome: Faster time to value and less reliance on engineering resources. 3. Strong behavioral visibility across humans, devices, and agents. Most modern attacks involve credential misuse or lateral movement. Rules alone are not enough to detect these patterns. Splunk provides behavior-based detection, but it often requires extensive tuning and operates outside a unified investigation workflow. Exabeam applies: ABA extends behavioral analytics to AI agents and non-human identities. It correlates activity across users, devices, and agents into a single investigation flow so analysts can understand how behaviors interact within an attack sequence. While Splunk can monitor agent activity and assign risk scores, it approaches this from an observability perspective. Exabeam integrates agent behavior directly into the investigation workflow, so all related activity is analyzed together. Outcome: Faster identification of high-risk behavior with unified investigation context. 4. Cloud-Native architecture built for scale. Splunk Cloud is a managed version of an architecture originally designed for on-premises deployments. Scaling often requires planning for storage, compute, and performance constraints. New-Scale Fusion is cloud native. It: * Processes high event volumes at scale * Unifies ingestion, parsing, analytics, and detection * Provides real-time visibility into service health and consumption OpenAPI Standard (OAS) support enables integration with broader security and IT ecosystems. Outcome: Consistent performance and visibility as data and complexity grow. 5. AI agents that drive investigation and detection outcomes. Splunk AI Assistant focuses on generating SPL queries and summaries. Its use is limited and often dependent on specific configurations. Exabeam Nova is a coordinated system of seven AI agents embedded into the detection, investigation, and response workflow: * Advisor Agent: Provides posture insights, MITRE ATT&CK(R) alignment, and prioritized recommendations through Outcomes Navigator * Search Agent: Converts natural language into Exabeam Query Language (EQL) aligned to the Common Information Model (CIM) * Visualization Agent: Build dashboards and charts from search results * Threat Scoring Agent: Applies adaptive learning to prioritize activity with dynamic risk scores * Investigation Agent: Generates summaries and recommends next steps * Analyst Assistant Agent: Surfaces evidence and guides investigators in real time * Rule Creator Agent: Translates natural language and observed attack patterns into correlation rules aligned to CIM and ATT&CK to accelerate detection coverage These agents work together within a unified workflow, reducing manual effort and improving investigation consistency. Outcome: Faster investigations, improved prioritization, and reduced analyst workload. 6. Measurable detection coverage with Outcomes Navigator. Security teams often lack visibility into whether their SIEM is detecting meaningful threats and how gaps translate to business risk. Splunk Security Essentials (SSE) is a content library that helps teams implement security use cases and map detections to frameworks like ATT&CK. While it highlights detection gaps, it provides limited visibility into exposure and only indirect insight into business risk. Outcomes Navigator delivers: * Detection coverage mapped to ATT&CK * Visibility into gaps and exposure * Prioritized recommendations aligned to business outcomes It continuously tracks detection performance and program maturity without requiring custom dashboards. Outcome: Clear visibility into detection coverage and next steps to reduce risk. Conclusion. Log search alone can't meet the demands of modern security operations. Exabeam combines behavioral analytics, dynamic risk scoring, automated timelines, and AI agents to detect hidden risk in human, device, and agent activity. You gain a unified investigation workflow, faster response times, and measurable improvements in your security program without needing to rebuild your entire stack. Download the full comparison guide to see how to reduce cost, improve detection coverage, and accelerate investigations. Heidi Willbanks. Heidi Willbanks | Senior Product Marketing Manager, Content | Exabeam | Heidi Willbanks leads content strategy and go-to-market execution at Exabeam, focusing on product launches, cybersecurity solutions marketing, and technical alliances. She has 20+ years of marketing experience, including over a decade in information security and data privacy, and holds a Level IV certification from Pragmatic Institute. Heidi specializes in creating clear, technically accurate content for security practitioners and decision-makers. Learn about the Exabeam platform and expand your knowledge of information security with its collection of white papers, podcasts, webinars, and more.

Ten years in the SOC at RSAC: what Cisco Systems learned in 2026. Cisco Security and Splunk Security released the Findings Report from the Security Operations Center at RSAC 2026 Conference. This year marked the 10th year of the SOC at RSAC. Since 2017, the mission has stayed consistent: protect the conference network, educate attendees about what happens on an open wireless network, and innovate with new integrations, workflows, and security operations practices. The 2026 SOC was also an important step toward something bigger. Cisco Systems were not yet operating a fully agentic SOC at RSAC 2026, but the foundation was taking shape: integrated telemetry, automated escalation, full packet evidence, AI-protected workflows, and a closed-loop operating model between Cisco XDR and Splunk Enterprise Security. Those lessons helped inform the Agentic SOC work that followed at Cisco Live Americas 2026. RSAC is a uniquely valuable environment for learning. The Moscone Center wireless network is open and unsecured, similar to the networks people use every day in hotels, airports, coffee shops, and major events. The SOC does not decrypt encrypted traffic. Instead, the team uses network telemetry, DNS visibility, packet capture, threat intelligence, and integrated security tools to identify risk, investigate suspicious activity, and help attendees better protect themselves. For RSAC 2026, the team deployed the SOC in a Box architecture, connecting Endace full packet capture, Splunk Enterprise Security, Cisco XDR, Cisco Secure Firewall, Cisco Secure Access, Cisco AI Defense, ThousandEyes, Splunk Attack Analyzer, Cisco Secure Malware Analytics, Cisco Talos intelligence, and partner (alphaMountain, Pulsedive and StealthMole) and community threat intelligence sources. The full report includes the details, but a few themes stood out. First, integration changed how the SOC worked. Cisco XDR supported efficient triage and correlation, while Splunk Enterprise Security supported deeper investigation, hunting, enrichment, and reporting. Splunk SOAR helped connect the workflow so that context could move between systems instead of forcing analysts to manually re-enter evidence or switch consoles to understand what happened. Second, automation reduced toil. Cleartext credentials continued to appear on the network, but the team advanced the response model from standalone scripting to an integrated Splunk SOAR workflow. Detections became formal findings in Splunk Enterprise Security, and the playbook could notify affected users, update the finding, and close the case. That saved more than nine hours of analyst time during the event and created a repeatable model for future conferences. Third, encrypted traffic remained both a success and a challenge. Encryption helps protect attendee privacy, and the SOC does not decrypt attendee traffic. But defenders still need ways to identify threats. Cisco Secure Firewall's Encrypted Visibility Engine helped the team find meaningful signals in encrypted sessions without decryption, including activity that supported a malware investigation and response. Fourth, AI became part of the security story in two ways. The SOC used Cisco AI Defense to gain visibility into generative AI application usage and to help protect on-premises AI models running in the SOC in a Box. At the same time, the team observed that AI demonstrations and agentic applications can introduce risk when they are built or operated without basic secure communication controls. Finally, the human mission of the SOC remained the same. The report includes examples of accidental data exposure, insecure email, unsecured web applications, misconfigured access paths, exposed storage, phishing infrastructure, scam domains, and malware investigations. In each case, the goal was not only to detect the issue, but to help RSAC and affected attendees understand and reduce the risk. That is why the full Findings Report matters. It is not just a list of alerts. It is a field report from a live, high-pressure SOC operating in a real conference environment, where technology, process, automation, AI, and human judgment all have to work together. Download the full RSAC 2026 SOC Findings Report to see the architecture, metrics, investigations, lessons learned, and recommendations from the 10th year of the SOC. The core advice remains simple: encrypt, encrypt, never trust, and always verify. Its thanks to the engineers, analysts and partners who made the SOC possible. Director, Security Operations.