Splunk ES Engineer

Bachelor s degree in computer science , Information Systems, Cybersecurity, or equivalent professional experience

5-8+ years of hands-on Splunk experience in enterprise environments

3+ years of direct experience with Splunk knowledge management, CIM normalization, or SIEM content engineering in a large-scale deployment (20+ TB/day)

Deep expertise in Splunk Enterprise Security correlation search authoring, ES data models, risk-based alerting

Demonstrated experience managing knowledge object governance at scale across multi-team, multi-app Splunk environments

Strong proficiency in SPL including complex statistical pipelines, accelerated searches, and macro development

Experience developing and enforcing enterprise naming conventions and taxonomy standards for Splunk deployments

Proven ability to create and maintain technical documentation runbooks, standards guides, architecture documentation

Background in detection engineering, threat hunting, or SOC operations understanding of how knowledge objects serve analysts in practice

Splunk Certifications : Splunk Core Certified Consultant, Splunk Enterprise Security Certified Admin (SPLK-3001), Splunk Certified Architect one or more strongly preferred

Security Certifications : GIAC (GCIA, GCIH, GCED), or equivalent

Experience with Splunk SOAR (Phantom) playbook development, orchestration, and knowledge integration

Familiarity with Splunk UBA and behavioral analytics model management

Experience in healthcare or highly regulated industries (HIPAA, Federal (NIST), NYDFS, PCI)

Experience with infrastructure-as-code tools (Ansible, Terraform) for Splunk configuration management

Proficiency with LLM-powered tooling and AI-assisted automation for knowledge retrieval and content management

Experience supporting Splunk deployments in environments with 10,000+ users and multi-petabyte data retention

Familiarity with Kafka , streaming data pipelines, and real-time telemetry routing

For applications and inquiries, contact:View email address on us.fitly.work