Experience: 10+ Years
Visa: Any Visa (No OPT)
Job Overview:
We are looking for a Lead Splunk Engineer / Administrator to spearhead the technical delivery, architecture, and daily operations of our Splunk Managed Services portfolio. In this role, you will act as the principal architect and final escalation point for a vast, multi-tenant Splunk landscape spanning various enterprise clients.
You will manage the fine balance between protecting client infrastructure health, optimizing data ingestion pipelines to maintain healthy MSP service margins, and acting as a trusted advisor to client stakeholders (CISOs, IT Directors).
Key Responsibilities:
Multi-Tenant Architecture & Platform Engineering
Enterprise Blueprinting: Architect, build, and optimize complex, large-scale Splunk environments (Enterprise distributed setups and Splunk Cloud) mapped across disparate, hybrid-cloud client networks.
Pipeline & Cost Optimization: Strategize data-onboarding pipelines using Edge Processors and Ingest Processors to mask, filter, and aggregate log data at the perimeter—significantly driving down licensing and storage costs for clients.
Advanced Logging & Parsing: Supervise the onboarding of highly non-standard datasets. Write master-level regular expressions (props.conf, transforms.conf) to normalize inbound log streams against the Splunk Common Information Model (CIM).
Technical Consultation: Interface directly with key client accounts to map their compliance requirements (e.g., SOC2, HIPAA, NIST) and security initiatives directly into actionable Splunk dashboards, automated reports, and alerting frameworks.
Capacity Planning: Conduct regular infrastructure reviews and performance audits to advise clients on resource forecasting, node horizontal scaling, or migration paths to Splunk Cloud.
Required Skills & Qualifications
Experience: 7+ years of dedicated Splunk Administration and Engineering experience, featuring at least 3 years in a direct technical lead or senior-tier capacity within an MSP, MSSP, or multi-client consulting ecosystem.
Comprehensive expertise in distributed Splunk infrastructure (Indexer Clusters, Search Head Clusters, Deployers, Deployment Servers, Heavy Forwarders).
Mastery of core backend configuration workflows (inputs, outputs, props, transforms, limits, and indexes).
Deep, hands-on fluency with Linux/Unix environments, enterprise networking topologies (Syslog-NG, Firewalls, Load Balancers, Proxies), and REST APIs.
Solid experience using infrastructure-as-code or automation frameworks (e.g., Ansible, Terraform) to deploy Universal Forwarders across thousands of endpoints.
Education & Certifications
Splunk Enterprise Certified Architect (Highly Preferred/Required)
Splunk Cloud Certified Admin or Splunk Enterprise Certified Admin (Required)
Pluses: ITIL Certification, AWS/Azure/Google Cloud Platform Solutions Architect certifications, or cybersecurity benchmarks (CISSP, Sec+).
Never miss an opportunity! Create an alert based on the job you applied for.
