Description

Design, implement, and maintain security monitoring platforms using Splunk and Cribl Stream to optimize log ingestion, parsing, and detection capabilities.

This role is remote.

Responsibilities

• Deploy and configure Splunk Enterprise and Splunk Enterprise Security, including index management, forwarders, and clustered environments.
• Build and maintain log onboarding pipelines using Cribl Stream for routing, filtering, masking, and enrichment.
• Develop automation workflows using SOAR platforms like Tines or Splunk SOAR to integrate with Microsoft Defender, CrowdStrike, and Palo Alto.
• Optimize Splunk searches, dashboards, and correlation searches for performance, scalability, and accurate threat detection.
• Troubleshoot ingestion issues, parsing problems, and distributed architecture health, while creating technical documentation and runbooks.

Required Skills

• 5+ years of hands-on experience administering Splunk Enterprise and Splunk Enterprise Security (ES).
• Strong proficiency in Cribl Stream administration, pipeline development, and log normalization/CIM mapping.
• Deep understanding of log ingestion, field extraction, parsing, and data model creation.
• Proficiency in Splunk Search Processing Language (SPL) for complex queries and performance tuning.
• Experience integrating cloud and security tools (AWS, Azure, Okta, Zscaler) with Splunk via REST APIs and JSON.
• Scripting experience using Python, PowerShell, or Bash for automation and troubleshooting.
• Knowledge of Linux administration and troubleshooting.

Preferred Skills

• Experience with security automation platforms (Tines, Cortex XSOAR) and Microsoft Sentinel or CrowdStrike Falcon.
• Familiarity with Git, CI/CD, Infrastructure as Code, and the MITRE ATT&CK framework.

Key Skills

Education

Bachelor's degree