> Markdown version of [/jobs/ext/3738233-lead-splunk-engineer](https://www.wearedevelopers.com/jobs/ext/3738233-lead-splunk-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Lead Splunk Engineer

- **Company:** CATAPULT STAFFING LLC
- **Location:** Alexandria, VA, United States
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Amazon S3, Microsoft Azure, Cloud Computing, Cloud Storage, Cluster Analysis, Cyber Security, Information Engineering, Information Model, Virtualization Technology, Data Ingestion, Indexer, Splunk, Data Pipelines, Vmware
- **Published:** October 14, 2026
- **Apply:** https://www.clearancejobs.com/jobs/9241228/lead-splunk-engineer

## About the Role

Clearance: Active Top Secret / SCI
Experience: 8+ years of hands-on experience in enterprise Splunk architecture, data engineering, and complex cyber telemetry pipelines.
Splunk Suite: Master-level experience with Splunk Enterprise, Indexer Clustering, Search Head Deployer/Clusters, Enterprise Security (ES), IT Service Intelligence (ITSI), and SOAR.
Cribl Stream: Extensive experience with Cribl Stream architectural design, edge reduction, routing pipelines, worker groups, and archive replay.
Data Engineering: Proven track record leading data onboarding, custom field extractions, and CIM compliance.
Infrastructure: Solid expertise in virtualization (VMware) and cloud infrastructure (Azure)., Splunk Certified Architect or Enterprise Security Certified Admin.
Certified Cribl Stream Architect or Admin.

## Description

We are seeking a Lead Splunk & Cyber Data SME Engineer (8+ Years Experience) to lead the architectural design, sizing, deployment, and operationalization of a multi-site enterprise log aggregation and telemetry pipeline for the Test Resource Management Center (TRMC).

In this leadership role, you will lead high-level technical discussions with government stakeholders and prime partners, drive baseline architectural decisions, and oversee the end-to-end implementation of central/edge Cribl Stream clusters, Splunk Indexer Clusters, Splunk Enterprise Security (ES), and archive integration., Architectural Design & Client Leadership: Lead program kickoff meetings, validate reference architectures, confirm platform sizing, decide central substrates (on-prem VMware vs. Azure), and lead design/implementation discussions with client leadership.

Cribl Stream Pipeline Architecture: Architect and oversee remote Cribl worker group deployments across 3 sites (6 VMs total) with edge reduction/shaping, persistent queuing for 24-hour link loss, compressed TLS transport, and central routing/replay pipelines.

Splunk Enterprise & Security Architecture: Architect Splunk Indexer Clusters (RF3/SF2 resilience) with tiered retention (hot/warm ~180 days, cold ~730 days). Deploy dedicated ad-hoc search heads and Splunk Enterprise Security (ES) search heads, baseline correlation searches, and risk frameworks.

Data Onboarding & CIM Normalization: Direct the five-gate data onboarding process for priority sources, ensuring TA configurations, field extractions, and full Splunk Common Information Model (CIM) compliance.

Archive & System Control Plane: Integrate S3-compatible or Azure Blob object stores as Cribl destinations for full-fidelity off-license archiving and on-demand replay. Establish control plane components (Cribl Leader, Deployment Server, License Manager, Monitoring Console).

As-Built Documentation & Reference Pattern: Author comprehensive as-built documentation, operational runbooks, component inventories, and reference architectures to enable repeatable deployments across future classification domains.