Splunk Engineer

Job Summary:

We are seeking a highly skilled Splunk Engineer to design, implement, and maintain our Splunk infrastructure for log management, monitoring, and data analytics. The ideal candidate will have strong experience with Splunk Enterprise, data onboarding, creating dashboards, and using SPL (Search Processing Language) to support security, IT operations, and business intelligence needs.

Key Responsibilities:

• Design, configure, and maintain Splunk infrastructure, including indexers, forwarders, search heads, and deployment servers.

• Develop and optimize SPL queries, dashboards, alerts, and reports for stakeholders across security, IT operations, and business units.

• Ingest and normalize log data from various sources including servers, cloud services, network devices, and security tools.

• Implement and maintain data models, CIM compliance, and field extractions to support correlation and advanced analysis.

• Collaborate with security and IT teams to support SIEM and monitoring use cases (e.g., threat detection, incident response, performance monitoring).

• Troubleshoot issues in the Splunk environment, including search performance and data latency.

• Support Splunk Enterprise Security (ES) or Splunk ITSI as needed.

• Automate onboarding, parsing, and tagging of new data sources.

• Stay current with Splunk releases and new features, applying best practices for deployment and scalability.

• Maintain documentation of architecture, configurations, and procedures.

Required Qualifications:

• Bachelor's degree in Computer Science, Information Technology, or a related field (or equivalent experience).

• 2 5+ years of hands-on experience with Splunk (Enterprise, Cloud, or ES).

• Proficiency in SPL (Search Processing Language) and dashboard creation.

• Experience with data onboarding (Universal Forwarders, API, syslog, etc.).

• Knowledge of Linux/Unix systems and basic scripting (Bash, Python preferred).

• Familiarity with security operations or IT monitoring use cases.

• Experience with regex, field extraction, and data transformation.

Preferred Qualifications:

• Splunk certifications (e.g., Splunk Core Certified Power User, Splunk Certified Admin, or Splunk Enterprise Security Certified Admin).

• Experience with Splunk ITSI, Phantom/SOAR, or cloud platforms (AWS, Azure, Google Cloud Platform).

• Understanding of MITRE Telecommunication&CK framework, threat intelligence feeds, or cybersecurity principles.

• Familiarity with DevOps tools (Ansible, Git, CI/CD pipelines) for automated deployment.

Soft Skills:

• Strong analytical and problem-solving abilities.

• Ability to communicate technical details to non-technical stakeholders.

• Team player with a proactive and self-driven attitude.

• Ability to manage multiple tasks and priorities in a fast-paced environment.