Job Description:
Required
5+ years of hands-on experience with Splunk platform administration, with significant
depth in Splunk Enterprise Security.
Active Splunk certifications required: Splunk Enterprise Certified Admin and/or Splunk
ES Certified Admin.
Proven experience managing Splunk deployments in cloud environments (AWS, Azure,
or Google Cloud Platform).
Deep understanding of security monitoring, log management, SIEM operations, and
event correlation at enterprise scale.
Working knowledge of PCI DSS, SOX, and NIST CSF compliance frameworks and how
they translate into SIEM use cases and reporting requirements.
Strong SPL (Search Processing Language) proficiency, including complex statistical
commands, lookups, macros, and data models.
Experience with Splunk infrastructure components: indexers, search heads,
heavy/universal forwarders, deployment servers, and cluster management.
Excellent communication skills with the ability to translate complex technical concepts for
non-technical stakeholders.
Preferred
Experience in large-scale retail or similarly complex, high-transaction-volume
environments.
Familiarity with Splunk SOAR (formerly Phantom) and security automation/orchestration
workflows.
Background in detection engineering, threat hunting, or SOC operations.
Additional certifications such as CISSP, GIAC (GCIA, GCIH), or cloud security
credentials (AWS Security Specialty, AZ-500).
Experience with Infrastructure as Code (Terraform, Ansible) for Splunk deployment
management.
Scripting proficiency in Python, Bash, or PowerShell for automation and custom
integrations.
Never miss an opportunity! Create an alert based on the job you applied for.