> Markdown version of [/jobs/ext/2735093-splunk-engineer-2](https://www.wearedevelopers.com/jobs/ext/2735093-splunk-engineer-2). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Splunk Engineer 2

- **Company:** CATAPULT STAFFING LLC
- **Location:** Arlington, VA, United States
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Microsoft Azure, Linux System Administration, Role-Based Access Control, Azure Active Directory, Syslog, Extensible Markup Language (XML), Data Ingestion, Cyber Threat Analysis, Data Layers, Splunk
- **Published:** September 5, 2026
- **Apply:** https://www.clearancejobs.com/jobs/9145676/splunk-engineer-2

## About the Role

Remote (must be local to DC area incase customers need onsite support)
Must be US citizen with TS/SCI Eligibility, o Splunk certifications (Core Consultant, ES Admin, ITSI Admin, Enterprise Architect)
o Cribl experience (excluded now, likely future scope)
o Azure and Microsoft Entra ID administration depth
o DISA STIG/OS hardening and NIST SP 800-53 / RMF / ATO literacy
o Federal delivery at large scale (~10,000 users)

## Description

A hands-on senior Splunk consultant who can architect and build the platform, engineer the data layer, and stand-up Enterprise Security Premier, ITSI, and UEBA, while producing client facing documentation / cross train / manage scoping.

Must Have Skills:
o Experience deploying Splunk ITSI, UEBA, ES Premier
o Splunk Enterprise 10.x architecture: multisite indexer clustering and search head clustering
o SmartStore on Azure Hot Blob, plus Azure Archive Blob (GRS) for immutable backup
o Index design and retention strategy (per-index, 30-month hot tier, set at build)
o Deployment server, forwarder management, and Universal Forwarders at scale
o Monitoring Console, RBAC, TLS/certificates, Linux administration, syslog (rsyslog/syslog-ng)
o Data onboarding and CIM normalization (hard prerequisite for ES/UEBA)
o SplunkBase TA deployment and data model design/acceleration
o ITSI: install, KPIs/services/entities, content packs, event analytics (correlation searches, NEAPs, glass tables)
o Enterprise Security Premier: install/config, Assets & Identities against Microsoft Entra ID/AD, use-case library, threat intel, Risk-Based Alerting
o ES-embedded UEBA: configuration, identity/asset enrichment, 4-week baseline and tuning
o Expert SPL and private app/TA development (Simple XML and Dashboard Studio)
o Clear technical writing (gap analyses, mapping documents, readiness summaries)


## Related Videos

- [Better Together: Leveraging Your Observability Tools as a SIEM](https://www.wearedevelopers.com/videos/2118-better-together-leveraging-your-observability-tools-as-a-siem)
- [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture)
- [Why Your AI Agent Keeps Hallucinating Your Data: Building Deterministic Context Layers](https://www.wearedevelopers.com/videos/2055-why-your-ai-agent-keeps-hallucinating-your-data-building-deterministic-context-layers)
- [Hacking MSSQL on Cloud. All of them. How I became sysadmin on Azure, AWS, GCP and Alibaba.](https://www.wearedevelopers.com/videos/100339-hacking-mssql-on-cloud-all-of-them-how-i-became-sysadmin-on-azure-aws-gcp-and-alibaba)
- [Automated MS SQL Server database deployments with dacpacs and Azure DevOps](https://www.wearedevelopers.com/videos/334-automated-ms-sql-server-database-deployments-with-dacpacs-and-azure-devops)
- [How to govern Vibe Coding for the Enterprise](https://www.wearedevelopers.com/videos/100290-how-to-govern-vibe-coding-for-the-enterprise)

## Related Articles

- [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers)
- [Dev Digest 162: AI careers, MCP, AWS best practices & floppy sweaters](https://www.wearedevelopers.com/magazine/571-dev-digest-162-ai-careers-mcp-aws-best-practices-floppy-sweaters)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents)
- [Highest Paying Tech Companies for Developers](https://www.wearedevelopers.com/magazine/220-highest-paying-tech-companies-for-developers)
- [Dev Digest 164: AI Agents, AI Blindspots and MCP security problems](https://www.wearedevelopers.com/magazine/578-dev-digest-164-ai-agents-ai-blindspots-and-mcp-security-problems)