JOB OVERVIEWThe SIEM responsible for the architecture, deployment, and ongoing health of the Splunk platform that underpins security operations across government agencies. This role owns the underlying infrastructure - indexers, search heads, forwarders, and clustering - and ensures the environment is performant, resilient, secure, and scalable. The Platform Engineer partners with Data and Detection Engineers, IT teams, and stakeholders to deliver a stable foundation on which data ingestion and threat detection depend.
Essential Functions:- Platform Architecture and Deployment
- Design, deploy, and maintain Splunk environments, including indexer clusters, search head clusters, and forwarder tiers, to support enterprise-scale data collection and analysis.
- Architect distributed and clustered deployments for high availability and disaster recovery.
- Configuration and Optimization
- Optimize Splunk configurations to ensure efficient data storage, indexing, retrieval, and search performance.
- Manage index and storage design, data retention policies, and licensing to balance performance and cost.
- Capacity Planning and Scaling
- Monitor growth trends and forecast capacity needs across compute, storage, and licensing.
- Scale the environment proactively to meet increasing data volumes and user demand.
- Lifecycle Management
- Plan and execute Splunk version upgrades, patching, and platform migrations with minimal disruption.
- Manage app and add-on deployment across the environment using deployment servers and configuration management.
- Performance Monitoring and Troubleshooting
- Monitor system performance and troubleshoot issues related to indexing, search performance, and resource utilization.
- Implement optimizations to enhance the platform's efficiency, stability, and responsiveness.
- Platform Security and Compliance
- Implement access controls, role-based access (RBAC), hardening, and best practices to protect the platform and ensure compliance with relevant regulations and standards.
- Support audit, accreditation, and continuous monitoring requirements for the environment.
- Training and Documentation
- Provide guidance to team members on Splunk platform administration and best practices.
- Create and maintain documentation for platform architecture, configurations, and operational procedures.
Qualifications:- US Citizen with an active Top Secret Security Clearance.
- Bachelor's degree in Computer Science or a related field plus 6 years of related experience.
- Proven experience designing, deploying, and administering distributed and clustered Splunk environments, preferably within government or enterprise settings.
- Strong understanding of Splunk architecture, indexer/search head clustering, forwarder management, and licensing.
- Experience with capacity planning, performance tuning, and platform upgrades.
- Familiarity with security standards and regulations (NIST, FISMA, etc.) applicable to platform operation and accreditation.
- Splunk Enterprise Certified Admin or Architect certification preferred.
- Excellent problem-solving skills and the ability to diagnose and resolve complex technical issues.
- Strong written and verbal communication skills.
PHYSICAL REQUIREMENTS & ENVIRONMENTAL CONDITIONS- Inside office environment.
- Working on a computer for long periods of time.
- May involve long period of sitting at a desk.
- The work environment is fast-paced and sometimes involves extreme deadline pressures.
OTHER DUTIESThis job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee for this job. Duties, responsibilities, and activities may change at any time with or without notice.
