Description

You will own the administration, architecture, and daily operations of Splunk Enterprise and Splunk GovCloud environments. You will optimize data ingestion pipelines, troubleshoot complex indexing issues, and build interactive dashboards for technical and business stakeholders.

This role is hybrid.

Responsibilities

• Administer clustered on-prem Splunk Enterprise and Splunk Cloud (Multi-AZ), managing upgrades, capacity planning, and high availability.
• Write and optimize complex SPL queries, including transforming commands, eval functions, and sub-searches to extract and manipulate data effectively.
• Design and maintain interactive dashboards and visualizations using SPL and XML to communicate insights to diverse teams.
• Manage data ingestion from diverse sources (AWS, Databricks, Snowflake, custom apps) using forwarders, S3 pipelines, and tools like Cribl.
• Troubleshoot backend ITSI issues, Java/RHEL compatibility constraints, and perform root-cause analysis for data latency or loss.

Required Skills

• 7+ years of relevant work experience in Splunk administration and architecture.
• Strong proficiency in Splunk Search Processing Language (SPL) and query optimization.
• Experience with Splunk Enterprise (clustered on-prem) and Splunk Cloud/GovCloud.
• Proficiency in Python, Bash, and PowerShell for automation and data processing.
• Knowledge of IT infrastructure, networking, and security fundamentals.
• Experience integrating Splunk with Archer, ServiceNow, Azure, and AWS.
• Ability to create dashboards using XML (Classic).

Preferred Skills

• Experience with Cribl configuration and upgrades.
• Familiarity with AI Toolkit (AITK/MLTK) for predictive analytics and anomaly detection.
• Gov/Federal contracting experience with FedRAMP/FISMA processes.

Key Skills

Education

Bachelor's or Master's degrees