Description

Key Responsibilities

Administer, maintain, and optimize Splunk environments, including Splunk Cloud and Splunk GovCloud deployments.

Develop and enhance complex Splunk Search Processing Language (SPL) queries for data analysis, reporting, and operational monitoring.

Design, build, and maintain dashboards, visualizations, alerts, and reports for technical and business stakeholders.

Configure and manage data ingestion pipelines from servers, applications, cloud platforms, endpoints, and other data sources.

Manage forwarders, inputs, indexing strategies, and data retention policies.

Implement and support integrations with enterprise platforms such as ServiceNow, Azure, AWS, and other security and IT management tools.

Configure and manage data forwarding solutions using technologies such as Syslog-NG, Cribl, AWS Lambda, and Azure Function Apps.

Develop automation solutions using Python, Bash, and PowerShell to streamline operational processes and data workflows.

Monitor and troubleshoot Splunk infrastructure, data pipelines, and system performance issues.

Collaborate with cross-functional teams to support security monitoring, incident response, and operational analytics initiatives.

Support AI and advanced analytics capabilities within Splunk, including predictive analytics, anomaly detection, and forecasting use cases.

Required Qualifications

Bachelor’s degree in Information Systems, Computer Science, or a related field with at least 7 years of relevant experience; OR Master’s degree with at least 5 years of relevant experience.

Splunk Cloud Certified Admin Certification (Required).

Strong expertise in Splunk Search Processing Language (SPL), including advanced queries, transforming commands, eval functions, and sub-searches.

Hands-on experience with Splunk administration, data ingestion, indexing, and log management.

Experience creating dashboards, reports, and visualizations for operational and business insights.

Proficiency in scripting and automation using Python, Bash, and PowerShell.

Strong understanding of IT infrastructure, networking, and cybersecurity concepts.

Experience working with both self-hosted and cloud-based Splunk environments.

Experience integrating Splunk with enterprise and cloud platforms such as Azure, AWS, and ServiceNow.

Knowledge of data forwarding and collection technologies, including Syslog-NG, AWS Lambda, and Azure Function Apps.

Strong troubleshooting, analytical, and problem-solving skills.

Preferred Qualifications

Experience with Cribl for data routing, transformation, and pipeline management.

Experience with Armis or similar asset visibility and security platforms.

Knowledge of Splunk AI Toolkit (AITK/MLTK) and machine learning-driven analytics.

Familiarity with Splunk MCP Server implementation and governance considerations.

Experience monitoring AI platforms, large language models (LLMs), AI agents, and supporting infrastructure.

Exposure to AI-assisted query generation and advanced observability solutions

Key Skills

Education

Bachelor's or Master's degrees