Splunk Engineer

Role Overview The candidate will be part of a team of Splunk Engineers maintaining various client Splunk instances with a heavy emphasis on data onboarding, content development, reporting, and visualizations. All candidates must possess prior Splunk engineering and administration experience, meet the necessary certification prerequisites, and work well in a team environment. Background supporting federal customers is a plus. Qualifications US Background Check Required Splunk Consultant Certification Heavy Splunk ES Experience Experience ingesting logs into Splunk via Cribl Experience with RBA (Risk Based Alerting) Responsibilities Develop and implement actionable alerts and workflows for Splunk as a SIEM (Security Information & Event Management) tool. Develop and implement Apps & Knowledge Objects (KOs) such as dashboards, reports, and data models. Work with the Splunk Architect/Admin to promote private KOs to Global KOs. Assist and/or train CISO Splunk Engineering teams on data lifecycle. Support, assist, train, and host workshops for CISO teams and analysts on searching and content development. Develop and implement automation to improve efficiency of CISO workflows using Splunk Assist, and develop advanced security use cases. Develop risk rules and risk incident rules to correlate and alert to significant cyber events. Develop custom dashboards specific to RBA to highlight risk detail, health analysis, and risk suppression. Configure incident response and remediation workflows for ES around notable events (RBA or otherwise alerted). Develop custom machine learning (ML) models to support anomaly‑detection based augmentation of alerting. Work with numerous stakeholders to implement & maintain event logging from various operating systems, applications, identity providers, network infrastructure, and cloud service providers, understanding network protocols, OS, applications, and device event telemetry. Benefits Competitive salary, paid twice per month Best in class medical coverage; 100% of premiums covered by True Zero Company-wide new business incentive programs Contribution Incentives (white papers, blog posts, internal webinars, etc.) 3 weeks of PTO starting + 11 paid holidays annually 401(k) program with 100% company match on the first 4% Monthly reimbursement of cell phone and home internet costs Paternity/maternity leave Investment in training and certifications to broaden and deepen technical skills #J-18808-Ljbffr