> Markdown version of [/jobs/ext/3582279-splunk-siem-data-onboarding-engineer](https://www.wearedevelopers.com/jobs/ext/3582279-splunk-siem-data-onboarding-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Splunk SIEM Data Onboarding Engineer

- **Company:** Nat Booz Allen
- **Location:** United States
- **Salary:** $99,000.0 - $225,000.0
- **Contract:** Permanent contract
- **Skills:** Bash Shell, Cyber Security, Linux, Python (Programming Language), Networking Basics, Parsing, Windows PowerShell, Regular Expressions, Ansible, Tcpdump, Wireshark, Scripting, Firewalls (Computer Science), Git, Selinux, Information Technology, Restful APIs, Splunk, Software Version Control, Data Pipelines
- **Published:** October 4, 2026
- **Apply:** https://www.thejobnetwork.com/job/3df3c058-3a0e-4dfe-9a37-229d68c985fd/splunk-siem-data-onboarding-engineer

## About the Role

* 2+ years of experience managing and configuring Splunk
\n

 * 2+ years of experience in Splunk architecture, including indexers, search heads, forwarders, and deployment server
\n

 * 2+ years of experience building pipelines to parse, normalize, enrich, mask or dedupe, and route data to Splunk
\n

 * 2+ years of experience in Linux and Windows administration
\n

 * Active TS/SCI clearance; willingness to take a polygraph exam
\n

 * Associate's degree and 5+ years of experience supporting IT projects and activities, Bachelor's degree and 3+ years of experience supporting IT projects and activities, Master's degree and 1+ years of experience supporting IT projects and activities, or 10+ years of experience supporting IT projects and activities in lieu of a degree
\n

 * Ability to obtain a DoD 8570 IAT Level III Certification such as SecurityX, CCNP Security, CISA, CISSP, GCED, GCIH, or CCSP Certification, and a DoD 8570 Cyber Security Service Provider - Infrastructure Support Certification such as CEH, CySA+, GICSP, SSCP, CHFI, CFR, Cloud+, or CND Certification, within 30 days of start date
\n, * 2+ years of experience with networking fundamentals, including TCP/UDP, TLS, syslog transport, firewall ports, and common transport issues
\n

 * 2+ years of experience in basic troubleshooting with tools such as tcpdump or wireshark, basic vi/vim usage, setfacl, and SELinux
\n

 * 1+ years of experience with STIGs or other organizational hardening standards working in regulated environments
\n

 * 1+ years of experience with regex skills for field extraction and event breaking
\n

 * Experience in SPL for validation, troubleshooting, and basic dashboards
\n

 * Experience with scripting languages such as Python, Bash, or PowerShell
\n

 * Experience with Cribl sources, destinations, routes, and collectors
\n

 * Experience with Splunk REST API for automation and operational tasks
\n

 * Knowledge of Git for code version control
\n

 * Knowledge of Ansible playbooks
\n