Data Intake & Integrations (D&I) Analyst- Mid (Splunk)

Data Intake & Integrations (D&I) Analyst- Mid (Splunk) Analyst to join our unique team of multidisciplined experts onsite in McLean, VA.

Team Description:

The DI&I team is the gateway for all log and data sources entering TESIEMS, ensuring ingested data is normalized, structured, and tagged for maximum utility. The team measures deviations in log formats, enables data segregation by Treasury component and FISMA boundary, and leads the data framework that monitors key data metrics and identifies coverage or quality gaps. DI&I coordinates with federal stakeholders, bureau security teams, and third-party vendors to onboard and standardize data feeds; leads rapid response when data pipelines are disrupted; supports SOC consolidation and multitenancy (alerts, notifications, content sharing, and access across bureaus); manages orchestration tasks such as audit-logging pipelines and ticketing automation; and integrates with asset management, compliance, and threat intelligence systems via APIs, connectors, and pipelines.

Roles and Responsibilities:

Provide operational and engineering support for the Department of the Treasury's enterprise Splunk environment under the Treasury Enterprise SIEM (TESIEMS) program. The role administers Splunk, onboards new data sources, ensures data quality and normalization, and maintains continuous visibility across enterprise systems, enabling Treasury SOC teams to detect, analyze, and respond to cybersecurity threats and to meet compliance reporting requirements. More specifically:

• Perform day-to-day Splunk administration, including monitoring system health, managing indexes, and troubleshooting ingestion and search performance issues.
• Support Splunk operations in hybrid environments (on-premises servers, AWS compute/storage, Linux VMs).
• Apply patches, upgrades, and configurations to maintain the stability and compliance of Splunk infrastructure.
• Onboard new data sources into Splunk using syslog, HTTP Event Collector (HEC), JSON feeds, and APIs.
• Normalize and validate ingested data to align with the Splunk Common Information Model (CIM) and SOC use cases.
• Collaborate with system owners, engineers, and SOC analysts to configure log forwarding and resolve onboarding issues.
• Develop and maintain ingestion pipelines that support large-scale Treasury SOC operations.
• Tune parsing, field extractions, and source types for optimal indexing and search performance.
• Document and maintain data onboarding procedures, schemas, and configuration standards.
• Ensure Splunk onboarding and data retention configurations align with Treasury security and compliance requirements (NIST RMF and FISMA).
• Generate audit-ready intake documentation and data validation reports for compliance reviews.
• Work with compliance and CD&M teams to ensure Splunk data supports continuous monitoring and reporting mandates.
• Provide Tier II/III Splunk intake and administration support, escalating complex issues to senior Splunk engineers as required.
• Partner with SOC analysts and content engineers to ensure onboarded data supports detection, dashboards, and reporting needs.
• Contribute to DI&I process-improvement initiatives that streamline intake and optimize operational workflows

Requirements

Knowledge:

• Cybersecurity principles and practices, with broad understanding of related cybersecurity specialty areas.
• Splunk Enterprise architecture and the Splunk Common Information Model (CIM).
• Hybrid infrastructure: on-premises servers, AWS compute/storage, virtual machines, and Linux environments.
• Incident detection, incident response, and security event management.
• NIST SP 800-53, NIST RMF, FISMA, FedRAMP, and DISA STIGs, and their application in SOC environments.

Skills:

• Splunk Enterprise administration (indexes, user management, system performance).
• Splunk data onboarding using syslog, HEC, JSON, APIs, and other ingestion methods.
• Normalizing log data to Splunk CIM standards; tuning parsing, field extractions, and source types.
• Scripting and automation in Python, Bash, or PowerShell for ingestion testing and log data analysis.
• Use of security tools such as SIEMs (e.g., Splunk), IDS/IPS, and endpoint detection.
• Strong technical documentation and communication skills.

Abilities:

• The ability to solve complex and unclear technical problems.
• The ability to develop and implement technical solutions independently.
• The ability to validate, troubleshoot, and normalize log data for operational and compliance use.
• The ability to assess the impact of changes on end-products or solutions.
• The ability to apply strong analytical and critical-thinking skills.
• The ability to collaborate with SOC teams, content engineers, internal cybersecurity experts, and system stakeholders.

Required Qualifications:

Certifications:

Required: Splunk Core Certified User.

Preferred: At least one higher-level Splunk certification - Splunk Enterprise Certified Architect, Splunk Enterprise Security Certified Admin, Splunk SOAR Certified Automation Developer, Splunk Cloud Certified Admin, or Splunk IT Service Intelligence (ITSI) Certified Admin.

Desirable: Relevant cybersecurity certifications such as CISSP, CISM, or CompTIA CySA+.

Education:

• Bachelor's Degree in Cybersecurity, Computer Science, Information Technology, or Related Field

[As a substitution for a Bachelor's degree-four (4) additional years of relevant experience (11 years total)

Other:

• Seven (7) years of relevant experience.
• Must be a US Citizen.
• Prior SOC or Department of the Treasury experience preferred.

Clearance:

• Active Secret clearance required (interim Secret not accepted).

Min $102,000 to $142,425

The estimate displayed represents the typical salary range for this position and is just one component of Pueo's total compensation package for employees. Other rewards may include annual bonuses, short- and long-term incentives, and program-specific awards. In addition, Pueo provides a variety of benefits to employees.

BENEFITS:

At Pueo, our benefits are designed to help keep you at your best beyond the work you do with us daily. We're fully committed to the growth of our employees. From fully comprehensive medical plans to professional development resources, we are there to support you all the way.