|
Description
|
Splunk Security Engineer with 7-8 years of experience in SIEM engineering, security monitoring, and threat detection.
Deliverables
-
Administration, configuration, maintenance, and technical support of the Splunk Enterprise and Splunk Enterprise Security platforms.
-
Successful onboarding and integration of assigned enterprise applications, systems, infrastructure, and log/data sources into Splunk.
-
Configuration and optimization of log ingestion, parsing, normalization, indexing, retention, search performance, and data-management processes.
-
Development, enhancement, and maintenance of Splunk searches, alerts, dashboards, reports, data models, applications, add-ons, and security/compliance content.
-
Development and maintenance of custom Splunk solutions and automation using SPL, Python, Bash, SimpleXML and other applicable technologies.
-
Technical recommendations and implementation support related to Splunk architecture, infrastructure standards, capacity, performance, scalability, high availability, upgrades, platform refreshes, and lifecycle management.
-
Support for Splunk integrations with business-critical enterprise applications, cloud platforms, security technologies, and observability systems.
-
Technical support for platform migrations, upgrades, deployment automation, CI/CD processes, and infrastructure modernization activities as assigned.
-
Troubleshooting, root-cause analysis, and resolution recommendations for Splunk platform, ingestion, integration, performance, and production-support issues.
-
Technical documentation covering configurations, architecture, integrations, deployment procedures, operational processes, troubleshooting procedures, and implemented solutions.
-
Knowledge transfer, technical guidance, and mentoring to client and project team members regarding Splunk administration, engineering, architecture, and operational best practices.
-
Integrate and onboard diverse log sources into Splunk, including Windows, Linux, Active Directory, Cloud (AWS/Azure/Google Cloud Platform), Firewalls, EDR, IAM, and network security tools.
-
Troubleshoot log ingestion, parsing, indexing, CIM mapping, and data quality issues.
-
Develop and optimize SPL queries, dashboards, reports, and correlation searches.
-
Design, tune, and maintain detection rules/use cases to improve detection coverage and reduce false positives.
-
Perform proactive threat hunting using Splunk and security telemetry.
-
Conduct threat modeling exercises using frameworks such as MITRE ATT&CK and Cyber Kill Chain.
-
Integrate and leverage threat intelligence feeds to enhance detection capabilities.
-
Support incident investigations and collaborate with SOC and Incident Response teams.
-
Optimize Splunk performance, data retention, and search efficiency.
|
|
Top Skills
|
Required Skills:
-
Strong hands-on experience with Splunk Enterprise and Splunk Enterprise Security (ES).
-
Expertise in SPL query development and troubleshooting.
-
Experience onboarding and managing enterprise log sources.
-
Knowledge of threat detection, threat hunting, and detection engineering.
-
Experience tuning SIEM alerts and reducing false positives.
-
Strong understanding of Windows, Linux, networking, cloud security, and security operations.
-
Familiarity with MITRE ATT&CK, threat intelligence, and incident response processes.
-
Preferred Certifications: Splunk Enterprise Certified Admin/Architect, SC-200, CISSP, GCIH, GCIA.
|
.png%3Fformat%3Dwebp&w=1080&q=75)
