Bachelor's degree in Computer Science, IT, Cybersecurity, Engineering, or related field with 8 years of experience, or equivalent education and experience.
5+ years of hands-on Splunk experience in an enterprise setting.
Proven track record in designing, implementing, and troubleshooting Splunk environments.
Experience developing Splunk searches, dashboards, alerts, and reports using SPL.
Familiarity with enterprise log ingestion and data onboarding from various technology platforms.
Knowledge of Splunk architecture components like forwarders, indexers, and search heads.
Experience supporting cybersecurity operations, including SIEM and SOC.
Responsibilities
Serve as the technical architect and subject matter expert for the Splunk environment.
Design and maintain scalable Splunk architectures for security monitoring and analytics.
Develop and manage Splunk infrastructure components, including indexers and search heads.
Create data ingestion strategies from diverse enterprise sources.
Optimize Splunk searches, reports, dashboards, and alerts using SPL.
Integrate Splunk with various security and enterprise technologies.
Analyze and recommend optimizations for Splunk performance and capacity.
Benefits
Opportunity to work on mission-critical cybersecurity projects.
Engagement with a federal customer, enhancing public sector experience.
Potential for professional development and technical mentoring.
Involvement in cutting-edge technology and architecture modernization.
Collaborative work environment with government and technical stakeholders.
Full Job Description
Business Title:
Splunk Architect
Location:
Oakton, Virginia
Clearance:
Active Top Secret (TS) clearance required with eligibility for Sensitive Compartmented Information (SCI).
Position Summary:
Definitive Innovative Solutions (DIS) is seeking a highly skilled Splunk Architect to lead the design, implementation, modernization, and optimization of enterprise Splunk platforms supporting mission-critical cybersecurity, operational, and analytics requirements for a federal customer.
Duties and Responsibilities
Serve as the technical architect and subject matter expert for the customer's enterprise Splunk environment.
Design, implement, and maintain scalable Splunk architectures supporting enterprise security monitoring, operational analytics, and mission requirements.
Develop and maintain Splunk infrastructure, including indexers, search heads, deployment servers, forwarders, and associated platform components.
Develop architecture standards, technical designs, configuration standards, and implementation plans for Splunk capabilities.
Design and implement data ingestion strategies from network, security, infrastructure, application, cloud, endpoint, and other enterprise sources.
Develop and maintain Splunk data models, indexes, sourcetypes, field extractions, parsing rules, and data normalization strategies.
Develop and optimize Splunk Search Processing Language (SPL) searches, reports, dashboards, alerts, and correlation searches.
Support development and tuning of security detections, use cases, and analytics in coordination with Security Operations Center (SOC) and cybersecurity teams.
Integrate Splunk with security and enterprise technologies, including SIEM/SOAR platforms, endpoint security, vulnerability management, identity and access management, network security, cloud platforms, and ticketing systems.
Design and implement Splunk Enterprise Security capabilities, including correlation searches, notable events, risk-based alerting, dashboards, and security monitoring workflows, as applicable.
Analyze Splunk performance, capacity, indexing rates, search performance, storage utilization, and system health; recommend and implement optimization measures.
Establish and maintain Splunk health, availability, performance, and capacity monitoring.
Troubleshoot complex Splunk infrastructure, ingestion, search, integration, and performance issues.
Develop automation and repeatable processes to improve Splunk administration, deployment, configuration management, and operational efficiency.
Support Splunk upgrades, migrations, architecture modernization, and technology refresh activities.
Evaluate new Splunk capabilities and recommend enhancements based on customer mission requirements.
Establish and maintain technical documentation, including architecture diagrams, configuration standards, data source inventories, operating procedures, and troubleshooting guides.
Ensure Splunk architecture and implementation comply with applicable federal security requirements, customer policies, configuration standards, and contract requirements.
Support cybersecurity assessments, audits, Authority to Operate (ATO) activities, continuous monitoring, and security control implementation as required.
Collaborate with government personnel, contractors, system owners, cybersecurity personnel, and technical stakeholders to identify requirements and resolve technical issues.
Participate in technical reviews, design sessions, change-control activities, and engineering working groups.
Provide technical mentoring and knowledge transfer to Splunk administrators, engineers, analysts, and other technical personnel.
Identify opportunities to improve system reliability, scalability, security, automation, and operational efficiency.
Perform other duties as assigned in support of contract and program objectives.
Minimum Qualifications
Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related technical discipline and 8 years of relevant experience, or an equivalent combination of education and experience.
5 or more years of hands-on Splunk experience in an enterprise environment.
Demonstrated experience designing, implementing, administering, and troubleshooting Splunk environments.
Demonstrated experience developing Splunk searches, dashboards, alerts, reports, and data integrations using SPL.
Demonstrated experience with enterprise log ingestion and data onboarding from multiple technology platforms.
Demonstrated experience with Splunk architecture components, including forwarders, indexers, search heads, and deployment/configuration management.
Demonstrated experience supporting cybersecurity, SIEM, SOC, or security monitoring operations.
Experience with Linux and/or Windows operating systems in an enterprise environment.
Ability to successfully complete required background investigations, suitability determinations, and customer-specific security requirements.
Ability to work onsite at the customer location when required by the contract.
Experience developing cybersecurity detection and monitoring use cases.
Experience integrating Splunk with cloud environments, particularly Microsoft Azure or AWS.
Experience with Splunk on-premises, cloud, or hybrid architectures.
Experience supporting federal civilian, Department of Defense, or Intelligence Community customers.
Experience with federal cybersecurity frameworks and requirements, including NIST, FISMA, RMF, FedRAMP, STIGs, and applicable agency security policies.
Experience with infrastructure-as-code, configuration management, or automation technologies such as Ansible, Terraform, or Git.
Experience with APIs and scripting languages such as Python, PowerShell, or Bash.
