Role OverviewManage, secure, maintain, and optimize the organization's Splunk environment supporting security monitoring, IT operations, data ingestion, dashboards, alerts, troubleshooting, and compliance.
Key Responsibilities- Administer Splunk Search Heads, Indexers, Forwarders, Deployment Servers, and clustered environments.
- Install, configure, upgrade, patch, and monitor Splunk infrastructure.
- Onboard and troubleshoot data from servers, applications, network devices, security tools, cloud platforms, and databases.
- Manage indexes, retention, storage, licensing, users, roles, authentication, and access controls.
- Develop and maintain searches, dashboards, reports, alerts, and security monitoring use cases.
- Optimize search performance, system health, capacity, availability, and licensing.
- Integrate Splunk with security and enterprise platforms through APIs and automation.
- Support SOC investigations, incident response, compliance, and audits.
Required Qualifications- 5+ years of experience with Splunk Enterprise
- Knowledge of Splunk architecture, distributed deployments, and configuration files.
- Experience administering Indexers, Search Heads, Forwarders, and Deployment Servers.
- Experience onboarding and troubleshooting diverse data sources.
- Strong analytical, troubleshooting, communication, and documentation skills.
Preferred Qualifications- Splunk Enterprise Certified Admin or Architect certification.
- Experience with Splunk Enterprise Security, Splunk SOAR, or Splunk Cloud.
- Experience with SIEM/SOC operations, cloud platforms, Kubernetes, or cybersecurity integrations.
- Knowledge of ITIL and enterprise change-management practices.
Core Competencies- Splunk administration
- Data ingestion and log management
- SIEM and security monitoring
- Linux and network troubleshooting
- Automation and scripting
- Performance and capacity management
- Documentation and collaboration
#PFFCUBO
