> Markdown version of [/jobs/ext/2709959-splunk-engineer-consultant-certified-es-accreditation](https://www.wearedevelopers.com/jobs/ext/2709959-splunk-engineer-consultant-certified-es-accreditation). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Splunk Engineer - Consultant Certified / ES Accreditation - **Company:** True Zero Technologies - **Location:** Annapolis, MD, United States - **Contract:** Permanent contract - **Skills:** Event Logging, Infrastructure as a Service (IaaS), Information Lifecycle Management, Machine Learning, Network Architecture, Network Administration, Network Protocols, Cloud Services, Security Information and Event Management, Software Engineering, Splunk - **Published:** September 4, 2026 - **Apply:** https://www.careerbuilder.com/job-details/splunk-engineer-consultant-certified-es-accreditation-required-r-00062-annapolis-md--812a7945-84cd-454a-acaa-285aa3f56c23 ## About the Role Administrative Skills, Analysis Skills, Automation, Background Investigation, Blog, Cellular Telephone, Consulting, Content Development, Customer Support/Service, Data Modeling, Develop and Maintain Customers, Incentive Programs, Incident Response, Infrastructure as a Service (IaaS), Knowledge Base, Machine Learning, Network Administration/Management, Network Protocols, Onboarding, Operating Systems, Product Demonstration, Reimbursement, Reporting Dashboards, Reporting Skills, Risk, Security Information and Event Management (SIEM), Service Delivery, Slack, Small Business, Software Development, Splunk, Team Player, Telemetry, Training/Teaching, Use Cases, Webinar, White Papers ## Description The candidate will be part of a team of Splunk Engineers maintaining various client's Splunk instances with a heavy emphasis on data on-boarding, content development, reporting, and visualizations. All candidates must possess prior Splunk engineering and administration experience, meet the necessary certification prerequisites, and work well in a team environment. Candidates with backgrounds supporting federal customers is a plus. As a TZT consultant, the candidate will receive access to the full knowledge base which is driven by the True Zero community as well as the technical backing of the entire PS team. True Zero encourages collaboration and growth through information sharing and knowledge workshops. The candidate will also have access to our internal Slack channel to stay connected with the team as well as the necessary tools to train, demo, test and grow their professional skills. Qualification Requirements * US Background Check Required * Splunk Consultant Certification * Heavy Splunk ES Experience * Experience ingesting logs into Splunk via Cribl is required * Experience with RBA * Develop and Implement Actionable Alerts and Workflow for Splunk as a SIEM (Security Information & Event Management) tool * Develop and Implement Apps & Knowledge Objects (KO) like Dashboard, Reports, Data Models * Work with the Splunk Architect/Admin to promote private KO to Global KO * Assist, and/or train CISO Splunk Engineering team on Data Lifecycle * Support Assist, train, and/or host workshops CISO teams and analysts on Searching and Content Development * Develop and implement automation to improve efficiency of CISO workflows using Splunk Assist in development of advanced security use cases in Splunk * Develop risk rules and risk incident rules to correlate and alert to significant cyber events * Develop custom dashboards specific to RBA (Risk Based Alerting) to highlight risk detail, health analysis and risk suppression * Configure incident response and remediation workflows for ES around notable events (RBA or otherwise alerted) * Develop custom machine learning (ML) models to support anomaly-detection based augmentation of alerting * Work with numerous stakeholders to implement & maintain event logging from various operating systems, applications, identity providers, network infrastructure, and cloud service providers. Understanding of network protocols, operating systems, applications, and device event telemetry ## Related Videos - [How I saved 200K/yr in direct costs writing 0 code lines in K8s](https://www.wearedevelopers.com/videos/1055-how-i-saved-200k-yr-in-direct-costs-writing-0-code-lines-in-k8s) - [Leverage Cloud Computing Benefits with Serverless Multi-Cloud ML ](https://www.wearedevelopers.com/videos/78-leverage-cloud-computing-benefits-with-serverless-multi-cloud-ml) - [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture) - [Is your backend a hodgepodge of queues, event stores and cron jobs? Durable Execution to the Rescue.](https://www.wearedevelopers.com/videos/744-is-your-backend-a-hodgepodge-of-queues-event-stores-and-cron-jobs-durable-execution-to-the-rescue) - [SRE Methods In an Agency Environment](https://www.wearedevelopers.com/videos/348-sre-methods-in-an-agency-environment) - [ZEISS & Microsoft - Building the Next Generation Medical Ecosystem in the Cloud](https://www.wearedevelopers.com/videos/424-zeiss-microsoft-building-the-next-generation-medical-ecosystem-in-the-cloud) ## Related Articles - [Dev Digest 121 - AI goes offline](https://www.wearedevelopers.com/magazine/456-dev-digest-121-ai-goes-offline) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Dev Digest 120 - Apple and peers](https://www.wearedevelopers.com/magazine/455-dev-digest-120-apple-and-peers) - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this) - [Dev Digest 132 - Binging WADFlix?](https://www.wearedevelopers.com/magazine/473-dev-digest-132-binging-wadflix) - [Dev Digest 162: AI careers, MCP, AWS best practices & floppy sweaters](https://www.wearedevelopers.com/magazine/571-dev-digest-162-ai-careers-mcp-aws-best-practices-floppy-sweaters)