Splunk Engineer(Hybrid Onsite)

Splunk Security Engineer with 7-8 years of experience in SIEM engineering, security monitoring, and threat detection.

Deliverables

• Administration, configuration, maintenance, and technical support of the Splunk Enterprise and Splunk Enterprise Security platforms.
• Successful onboarding and integration of assigned enterprise applications, systems, infrastructure, and log/data sources into Splunk.
• Configuration and optimization of log ingestion, parsing, normalization, indexing, retention, search performance, and data-management processes.
• Development, enhancement, and maintenance of Splunk searches, alerts, dashboards, reports, data models, applications, add-ons, and security/compliance content.
• Development and maintenance of custom Splunk solutions and automation using SPL, Python, Bash, SimpleXML and other applicable technologies.
• Technical recommendations and implementation support related to Splunk architecture, infrastructure standards, capacity, performance, scalability, high availability, upgrades, platform refreshes, and lifecycle management.
• Support for Splunk integrations with business-critical enterprise applications, cloud platforms, security technologies, and observability systems.
• Technical support for platform migrations, upgrades, deployment automation, CI/CD processes, and infrastructure modernization activities as assigned.
• Troubleshooting, root-cause analysis, and resolution recommendations for Splunk platform, ingestion, integration, performance, and production-support issues.
• Technical documentation covering configurations, architecture, integrations, deployment procedures, operational processes, troubleshooting procedures, and implemented solutions.
• Knowledge transfer, technical guidance, and mentoring to client and project team members regarding Splunk administration, engineering, architecture, and operational best practices.
• Integrate and onboard diverse log sources into Splunk, including Windows, Linux, Active Directory, Cloud (AWS/Azure/Google Cloud Platform), Firewalls, EDR, IAM, and network security tools.
• Troubleshoot log ingestion, parsing, indexing, CIM mapping, and data quality issues.
• Develop and optimize SPL queries, dashboards, reports, and correlation searches.
• Design, tune, and maintain detection rules/use cases to improve detection coverage and reduce false positives.
• Perform proactive threat hunting using Splunk and security telemetry.
• Conduct threat modeling exercises using frameworks such as MITRE ATT&CK and Cyber Kill Chain.
• Integrate and leverage threat intelligence feeds to enhance detection capabilities.
• Support incident investigations and collaborate with SOC and Incident Response teams.
• Optimize Splunk performance, data retention, and search efficiency.

• Strong hands-on experience with Splunk Enterprise and Splunk Enterprise Security (ES).
• Expertise in SPL query development and troubleshooting.
• Experience onboarding and managing enterprise log sources.
• Knowledge of threat detection, threat hunting, and detection engineering.
• Experience tuning SIEM alerts and reducing false positives.
• Strong understanding of Windows, Linux, networking, cloud security, and security operations.
• Familiarity with MITRE ATT&CK, threat intelligence, and incident response processes.
• Preferred Certifications: Splunk Enterprise Certified Admin/Architect, SC-200, CISSP, GCIH, GCIA.

• Dallas, As per team they need candidate to be onsite work from the Hitachi Dallas office at least 3 days per week (Tuesday, Wednesday, and Thursday)