Splunk ES Consultant

Working remotely on a contract basis, the Splunk ES Consultant will develop custom detection content, build and maintain Splunk Apps, and optimize data flow while collaborating with client security teams. Key responsibilities Develop custom detection content, including correlation searches, notable events, and alerts to identify threat activity Onboard new data sources and normalize them to the Common Information Model (CIM) Support and optimize large distributed clustered Splunk environments while documenting processes and key engineering decisions Required qualifications Several years of hands-on Splunk experience with real ES implementation and content development Strong proficiency in SPL and regular expressions Experience scripting in Python, Perl, or Bash Solid understanding of CIM and data onboarding at scale Experience supporting clustered Splunk environments in SOC or NOC settings