Description

Manage and optimize the Splunk Enterprise Security (ES) platform for effective security monitoring and threat detection.

This role is on-site.

Responsibilities

• Develop, deploy, and administer Splunk ES and its underlying infrastructure.
• Onboard critical data sources and normalize log data to the Common Information Model (CIM).
• Build Splunk dashboards for visibility and create security rules and alerts to detect anomalous activities.
• Troubleshoot log ingestion issues, connectivity problems, and virtual server availability.
• Implement security policies, standards, and guidelines through continuous security analysis.

Required Skills

• 7+ years of experience as a Splunk SIEM Engineer.
• Deep expertise in Splunk Enterprise Security (ES) administration and deployment.
• Hands-on experience with IDS/IPS, firewalls, NACs, and protocols like NetFlow.
• Proficiency with security tools including Snort, Bro, Palo Alto, Checkpoint, Arista, ISE, FireEye, and Gigamon.
• Experience managing cloud services including AWS, Azure, M365, and CASB.
• Strong understanding of network protocols and network monitoring tools.
• Working knowledge of both Linux and Windows operating systems.
• Experience with SOAR and Palo Alto Networks firewall platforms.

Preferred Skills

• Ability to perform complex security analysis to understand business impact.

Key Skills

Education

Bachelor's degree