> Markdown version of [/jobs/ext/3885824-splunk-cribl-platform-engineer-iv](https://www.wearedevelopers.com/jobs/ext/3885824-splunk-cribl-platform-engineer-iv). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Splunk & Cribl Platform Engineer IV

- **Company:** Shree Narayani Networking Solutions Llc
- **Location:** Richmond, VA, United States
- **Experience:** Expert
- **Contract:** Contract
- **Skills:** Amazon Web Services, Amazon S3, Microsoft Azure, Cloud Computing, Cyber Security, Data Integrity, Intrusion Detection and Prevention, Linux System Administration, Windows Servers, Red Hat Enterprise Linux, Security Log, Security Information and Event Management, Data Streaming, Data Logging, Google Cloud, Data Ingestion, System Availability, Indexer, Splunk, Data Pipelines
- **Published:** October 23, 2026
- **Apply:** https://www.dice.com/job-detail/468b2d86-ea3f-40c6-a876-17ba3d90d3c3

## About the Role

* 5+ years hands-on administering large-scale Splunk Enterprise or Splunk Cloud
 * Real platform admin experience, not dashboard or alert building for other applications, fastest screen-out
 * Indexer clustering and search head clustering
 * Universal and heavy forwarder architectures
 * SmartStore / S3-compatible object storage
 * SPL, search optimization, summary indexing, data model acceleration
 * Deep experience with security log ingestion and SIEM use cases
 * Proven ability to lead production incidents, perform RCA, drive preventive solutions
 * Strong Linux administration
 * Cribl administration (data routing, filtering, enrichment), required, not a nice-to-have
 * Excellent written and verbal communication, able to engage senior stakeholders

Desired Skills

 * Splunk certifications (Enterprise Admin or Enterprise Architect)
 * Splunk ES and SOAR experience (Phantom or equivalent, general exposure fine)
 * Cloud logging/security architecture exposure (AWS, Azure, Google Cloud Platform)
 * RHEL and Windows Server administration
 * Monitoring, APM, event management tool experience
 * Strong understanding of security, network, system, and database operations
 * Ability to balance multiple priorities in a fast-paced environment

## Description

Client is hiring a senior Splunk and Cribl platform engineer to support a large-scale, highly distributed Splunk Enterprise and Splunk Cloud environment that directly feeds the bank's Information Security and SOC teams. This is a production ownership role, not a monitoring or dashboard-building role.
What You'll Do
Splunk Platform Operations and Production Stability

 * Own end-to-end production support for search head clusters, indexer clusters, deployers, deployment servers, and forwarders
 * Ensure high availability, performance, and resiliency for security and operational use cases
 * Lead incident response, troubleshooting, root cause analysis, and service restoration for Splunk and Cribl
 * Proactively identify risks, capacity constraints, and performance bottlenecks, implement preventive and tuning measures

Security Log Ingestion and SIEM Enablement

 * Serve as a key technical enabler for Information Security and SOC teams
 * Onboard and normalize new data sources, supporting CIM compliance and field normalization
 * Tune ingestion pipelines using props.conf and transforms.conf
 * Build and support dashboards, searches, and alerts for threat detection and investigations

Cribl Data Pipeline Management

 * Administer and support Cribl for data routing, filtering, enrichment, and cost optimization
 * Ensure data integrity, reliability, and performance across ingestion pipelines
 * Collaborate with architecture teams on data flow strategies and onboarding standards

Governance, Documentation, Compliance

 * Develop and maintain runbooks, SOPs, installation guides, and operational documentation
 * Adhere to change management, incident management, and SLA commitments