Splunk Engineer L3

Job Title: Splunk Engineer L3



Location: Toronto, ON



Work Mode: Onsite



Employment Type: Full-Time

Job Description:
Provide L3 engineering and administration support for enterprise Splunk and SIEM environments
Design, implement, maintain, and optimize enterprise Splunk solutions across security monitoring and observability platforms
Work extensively with Splunk Enterprise, Splunk ITSI, UBA, CRIBL, and related security and monitoring technologies
Support Microsoft Security solutions including Microsoft Sentinel and integrate SIEM capabilities across enterprise environments
Apply advanced knowledge of Splunk architecture, administration, configuration, troubleshooting, performance tuning, and optimization
Develop and maintain Splunk solutions aligned with enterprise security, monitoring, governance, and operational requirements
Ensure CIM compliance and implement consistent data models, field extractions, normalization, and data quality standards
Design and maintain advanced Splunk dashboards, alerts, reports, searches, and monitoring solutions
Onboard and integrate APIs, databases, applications, and Splunk Base Apps into enterprise Splunk environments
Support security monitoring across Azure, AWS, Google Cloud, virtualized environments, and highly distributed infrastructure
Implement and support Microsoft security technologies and cloud security monitoring solutions
Analyze Windows, RHEL/Unix, network, server, application, and security log formats and develop appropriate ingestion and parsing strategies
Develop Python scripts and automation to improve Splunk administration, data onboarding, monitoring, and operational efficiency
Troubleshoot complex Splunk, SIEM, ingestion, search, performance, and integration issues at L3 level
Collaborate with security, infrastructure, cloud, network, application, and operations teams to resolve complex technical issues
Apply security best practices to cloud solutions operating within highly virtualized environments
Support enterprise monitoring toolsets and advanced security technologies across hybrid and multi-cloud environments
Maintain technical documentation, operational procedures, architecture standards, and troubleshooting runbooks
Participate in continuous improvement initiatives to enhance SIEM capabilities, security visibility, automation, and operational resilience

Required Qualifications:
Advanced knowledge and hands-on experience with Enterprise Splunk applications and Splunk administration
Strong experience with Splunk architecture, configuration, troubleshooting, performance optimization, dashboards, alerts, and reporting
Advanced experience with Splunk CIM compliance and data normalization
Strong experience with Azure Cloud and Microsoft Security solutions including Microsoft Sentinel
Experience with Splunk ITSI, UBA, and CRIBL is highly desirable
Strong understanding of cloud security within highly virtualized environments
Expert knowledge of Windows and RHEL/Unix log formats
Strong understanding of network, server, application, and security log formats
Proficiency in Python scripting and automation
Experience onboarding APIs, databases, applications, and Splunk Base Apps
Strong troubleshooting, analytical, communication, and stakeholder collaboration skills
Experience working within highly governed enterprise or financial services environments is preferred