SIEM/Splunk Engineer

Platform Administration: Maintain, monitor, and troubleshoot enterprise Splunk Enterprise and Splunk ES environments.

Migration Strategy: Lead and support the orchestration and transition of data pipelines, searches, and use cases from Splunk over to modern architectures like the Elastic Stack (Elastic Security).

Data Ingestion: Onboard enterprise log sources across syslog, Windows Event Collection (WEC), cloud environments (AWS/Azure), and APIs. Ensure data mapping aligns with Splunk CIM and Elastic Common Schema (ECS).

Content Development: Build and optimize complex SPL (Search Processing Language) queries, dashboards, alerts, and reporting mechanisms.

Experience: Minimum 5 years of IT/cybersecurity experience, with 3+ years specifically in hands-on enterprise SIEM administration.

Technical Skills: Strong proficiency with Linux command-line, scripting (Python, Bash, or PowerShell), and SQL querying.

Certifications: Splunk Core Certified Administrator/Power User, Security+, or equivalent certifications are highly preferred