Splunk SME_ Remote

Splunk SME_ Remote

Contract

Required Qualifications'

• Bachelor s degree in computer science, Information Systems, Cybersecurity, or equivalent professional experience
• 5-8+ years of hands-on Splunk experience in enterprise environments
• 3+ years of direct experience with Splunk knowledge management, CIM normalization, or SIEM content engineering in a large-scale deployment (20+ TB/day)
• Deep expertise in Splunk Enterprise Security correlation search authoring, ES data models, risk-based alerting
• Demonstrated experience managing knowledge object governance at scale across multi-team, multi-app Splunk environments
• Strong proficiency in SPL including complex statistical pipelines, accelerated searches, and macro development
• Experience developing and enforcing enterprise naming conventions and taxonomy standards for Splunk deployments
• Proven ability to create and maintain technical documentation runbooks, standards guides, architecture documentation
• Background in detection engineering, threat hunting, or SOC operations understanding of how knowledge objects serve analysts in practice

Preferred Qualification's

• Splunk Certifications: Splunk Core Certified Consultant, Splunk Enterprise Security Certified Admin (SPLK-3001), Splunk Certified Architect one or more strongly preferred
• Security Certifications: GIAC (GCIA, GCIH, GCED), or equivalent
• Experience with Splunk SOAR (Phantom) playbook development, orchestration, and knowledge integration
• Familiarity with Splunk UBA and behavioral analytics model management
• Experience in healthcare or highly regulated industries (HIPAA, Federal (NIST), NYDFS, PCI)
• Experience with infrastructure-as-code tools (Ansible, Terraform) for Splunk configuration management
• Proficiency with LLM-powered tooling and AI-assisted automation for knowledge retrieval and content management
• Experience supporting Splunk deployments in environments with 10,000+ users and multi-petabyte data retention
• Familiarity with Kafka, streaming data pipelines, and real-time telemetry routing