Description

You will own end-to-end production support for a distributed Splunk Enterprise and Splunk Cloud environment, ensuring high availability, scalability, and reliability.

This role is hybrid.

Responsibilities

• Ensure high availability, performance, and resiliency of the Splunk platform supporting security and operational use cases.
• Lead incident response, troubleshooting, root cause analysis, and service restoration for Splunk and Cribl platforms.
• Onboard and normalize new data sources, ensuring CIM compliance, field normalization, and SIEM best practices.
• Tune ingestion pipelines using props.conf and transforms.conf, implementing index-time and search-time optimizations.
• Develop and maintain runbooks, SOPs, installation guides, and operational documentation.

Required Skills

• 5+ years of hands-on experience administering large-scale Splunk Enterprise or Splunk Cloud environments.
• Strong expertise in Indexer clustering, search head clustering, Universal and heavy forwarder architectures, and SmartStore/S3-compatible object storage.
• Deep experience with security log ingestion and SIEM use cases.
• Proven ability to lead production incidents, perform RCA, and drive preventive solutions.
• Strong Linux administration skills and experience managing Splunk configuration and apps.
• Experience working in 24x7 production environments with high availability expectations.

Preferred Skills

• Experience with Splunk Enterprise Security (ES) and SOAR (Phantom or equivalent).
• Exposure to cloud logging and security architectures (AWS, Azure, GCP).

Key Skills

Education

Any Graduate