Senior Splunk Engineer

Overview

Senior Splunk Engineer

Responsibilities

• Administer and manage Splunk infrastructure across multiple clients in a multi-tenant MSSP environment
• Design and implement data onboarding processes including parsing, indexing, and field extractions
• Manage indexers, search heads, forwarders, and heavy forwarders for optimal performance
• Troubleshoot and resolve Splunk performance, search latency, and data ingestion issues
• Develop and optimize SPL queries, dashboards, alerts, and reports
• Ensure high availability, performance, and scalability of the Splunk platform
• Maintain forwarders, heavy indexers, search heads, and deployment servers
• Perform troubleshooting and root cause analysis for log ingestion and performance issues
• Support client onboarding, use case development, and data source integration
• Collaborate with SOC analysts, threat hunters, and client security teams to enhance visibility and detection
• Maintain compliance with internal security policies and relevant regulatory frameworks
• Implement role-based access control (RBAC), data retention policies, and compliance configurations
• Work closely with MSSP clients to understand their security monitoring requirements
• Provide Splunk expertise, troubleshooting, and best practices to internal and external stakeholders
• Produce documentation for architecture, configurations, processes, and operational runbooks

Requirements

• Bachelor's degree in Information Security, Computer Science, or a related technical field
• Minimum 3-5 years of experience as a Splunk Administrator, preferably in an MSSP or multi-client environment
• Deep hands-on experience with Splunk Enterprise, Splunk Enterprise Security (ES), and Splunk architecture components
• Strong knowledge of SPL, data onboarding (parsing, field extractions, props/transforms), and performance tuning
• Experience with Splunk integrations, including threat intelligence feeds, SOAR, and third-party tools
• Familiarity with Linux/Unix systems and scripting (e.g., Python, Bash, PowerShell)
• Strong understanding of SIEM use cases, threat detection, and log analysis
• Splunk certifications such as Splunk Certified Admin, Power User, or Architect are highly preferred
• Splunk certifications (Splunk Certified Admin, Splunk ES Certified, Splunk Architect)