Splunk & Cribl Platform Engineer IV

Client is hiring a senior Splunk and Cribl platform engineer to support a large-scale, highly distributed Splunk Enterprise and Splunk Cloud environment that directly feeds the bank’s Information Security and SOC teams. This is a production ownership role, not a monitoring or dashboard-building role. What You’ll Do Splunk Platform Operations and Production Stability

• Own end-to-end production support for search head clusters, indexer clusters, deployers, deployment servers, and forwarders
• Ensure high availability, performance, and resiliency for security and operational use cases
• Lead incident response, troubleshooting, root cause analysis, and service restoration for Splunk and Cribl
• Proactively identify risks, capacity constraints, and performance bottlenecks, implement preventive and tuning measures

Security Log Ingestion and SIEM Enablement

• Serve as a key technical enabler for Information Security and SOC teams
• Onboard and normalize new data sources, supporting CIM compliance and field normalization
• Tune ingestion pipelines using props.conf and transforms.conf
• Build and support dashboards, searches, and alerts for threat detection and investigations

Cribl Data Pipeline Management

• Administer and support Cribl for data routing, filtering, enrichment, and cost optimization
• Ensure data integrity, reliability, and performance across ingestion pipelines
• Collaborate with architecture teams on data flow strategies and onboarding standards

Governance, Documentation, Compliance

• Develop and maintain runbooks, SOPs, installation guides, and operational documentation
• Adhere to change management, incident management, and SLA commitments

• 5+ years hands-on administering large-scale Splunk Enterprise or Splunk Cloud
• Real platform admin experience, not dashboard or alert building for other applications, fastest screen-out
• Indexer clustering and search head clustering
• Universal and heavy forwarder architectures
• SmartStore / S3-compatible object storage
• SPL, search optimization, summary indexing, data model acceleration
• Deep experience with security log ingestion and SIEM use cases
• Proven ability to lead production incidents, perform RCA, drive preventive solutions
• Strong Linux administration
• Cribl administration (data routing, filtering, enrichment), required, not a nice-to-have
• Excellent written and verbal communication, able to engage senior stakeholders

Desired Skills

• Splunk certifications (Enterprise Admin or Enterprise Architect)
• Splunk ES and SOAR experience (Phantom or equivalent, general exposure fine)
• Cloud logging/security architecture exposure (AWS, Azure, Google Cloud Platform)
• RHEL and Windows Server administration
• Monitoring, APM, event management tool experience
• Strong understanding of security, network, system, and database operations
• Ability to balance multiple priorities in a fast-paced environment