Sr Splunk Engineer

We are seeking a Senior Splunk Engineer with deep expertise across the Splunk platform suite and Cribl to support critical customer infrastructure on-site in Reston, VA.

In this role, you will lead end-to-end architecture, implementation, and optimization of full-stack Splunk solutions ranging from back-end data onboarding, cluster administration, and infrastructure design to front-end correlation rule development, Enterprise Security (ES), and SOAR workflows. You will work closely with customer stakeholders across NIPR, SIPR, and Top Secret networks to understand their architectural landscape, optimize threat detection capabilities, and drive continuous platform capabilities., Architectural Leadership & Engineering: Serve as a technical SME for Splunk architectural design, installation, deployment, and optimization across classified and unclassified environments (NIPR/SIPR/TS).

Full-Stack Splunk Engineering: Manage and execute both front-end and back-end Splunk development, including indexer clusters, search heads, data ingestion pipelines, parser development, and custom correlation rules.

Security Operations & Automation: Design, configure, and maintain Splunk Enterprise Security (ES) and Splunk SOAR workflows to enhance security automation, incident response, and threat monitoring.

Telemetry & Pipeline Management: Integrate and leverage Cribl (Stream/Lake) for optimized log parsing, routing, data reduction, and pipeline management prior to Splunk ingestion.

Customer Collaboration & Solution Design: Engage directly with customer stakeholders to assess complex infrastructure environments, provide strategic guidance, and translate operational needs into robust engineering solutions.

Security Clearance: Active Top Secret / SCI with Counterintelligence (CI) Polygraph

Experience: 5+ years of hands-on engineering experience in complex, enterprise-level environments.

Education: Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related technical discipline (or equivalent experience).

Splunk Expertise: Comprehensive full-stack experience across the Splunk Enterprise ecosystem, including:

Splunk Enterprise / Core (Front-end & Back-end design, administration, and optimization)

Splunk Enterprise Security (ES)

Splunk SOAR (Automation & Playbooks)

Splunk IT Service Intelligence (ITSI)

Pipeline / Telemetry Tools: Practical experience using Cribl for data routing, transformation, and ingestion pipelines.

Classified Environment Experience: Demonstrated success providing end-to-end engineering support across NIPR, SIPR, and TS classified networks.

Preferred / Nice-to-Have Qualifications Containerization & IaC: Hands-on experience with Kubernetes, Helm-based deployments, or Infrastructure as Code (IaC) frameworks.

Splunk Certifications: Splunk Enterprise Security Certified Admin, Splunk Architect, or Splunk SOAR Certified Developer/Admin.

Customer Facing Experience: Proven ability to consult with client leads, build technical roadmaps, and assist in expanding enterprise platform offerings.