Splunk Administrator - Remote / Telecommute

Responsibilities: Splunk Infrastructure Management:

• Monitor and optimize the performance of Splunk clusters to ensure efficient data processing and search capabilities.
• Troubleshoot and resolve issues related to Splunk infrastructure, ensuring high availability and reliability.
• Experience in Splunk Cloud Infrastructure.

• Design and implement data ingestion strategies for various log sources into Splunk.
• Develop and maintain parsing configurations to normalize and enrich incoming data for effective analysis.
• Collaborate with application owners and IT teams to onboard new data sources into Splunk.

• Create and optimize search queries and reports to extract valuable insights from the indexed data.
• Customize and implement Splunk dashboards for different stakeholders to visualize key performance indicators and security metrics.

• Implement security best practices within Splunk to safeguard sensitive data.
• Collaborate with the security team to configure and monitor alerts for suspicious activities or security incidents.
• Ensure compliance with industry regulations and internal policies related to log management and data retention.

• Develop automation scripts using SPL (Search Processing Language) and other scripting languages to streamline administrative tasks.
• Continuously seek opportunities to improve efficiency through automation in Splunk processes.

• Maintain thorough documentation of Splunk configurations, processes, and troubleshooting procedures.
• Provide training and support to other IT team members on Splunk best practices and usage.