Splunk Engineer

About The Role

Key Responsibilities

• Deploy, configure, and maintain Splunk Enterprise and/or Splunk Cloud.
• Onboard logs from servers, network devices, firewalls, security tools, applications, and cloud platforms.
• Create and optimize Splunk searches, reports, dashboards, alerts, and correlation rules.
• Support SIEM use cases including threat detection, incident investigation, and compliance monitoring.
• Manage Splunk forwarders, indexers, search heads, deployment servers, and clustering where applicable.
• Troubleshoot data ingestion, parsing, indexing, search performance, and access issues.
• Develop field extractions, source types, CIM mappings, and data normalization.
• Integrate Splunk with security tools such as firewalls, EDR, IAM, vulnerability scanners, and ticketing platforms.
• Maintain documentation, runbooks, and operational procedures.
• Work with SOC, infrastructure, network, and application teams to improve visibility and monitoring.

Required Experience

• 3+ years of experience in Splunk administration, SIEM engineering, or security operations.
• Hands-on experience with Splunk Enterprise or Splunk Cloud.
• Strong knowledge of SPL.
• Experience onboarding and troubleshooting log sources.
• Good understanding of Linux and Windows systems.
• Knowledge of networking, security devices, and common log formats.
• Experience with dashboards, alerts, reports, and saved searches.
• Strong troubleshooting and communication skills.

Preferred Qualifications

• Splunk Enterprise Security experience.
• Experience with Splunk CIM and data models.
• Experience with Splunk Universal Forwarder and Heavy Forwarder.
• Knowledge of SOC operations, MITRE ATT&CK, incident response, and threat detection.
• Scripting experience in Python, Bash, or PowerShell.
• Experience with cloud platforms such as AWS, Azure, or GCP.
• Splunk certifications such as:

What We’re Looking For

• Detail-oriented and reliable.
• Strong problem-solving mindset.
• Comfortable working with security and infrastructure teams.
• Able to translate monitoring requirements into Splunk use cases.
• Focused on automation, documentation, and operational improvement.