• Administer Splunk Search Heads, Indexers, Forwarders, Deployment Servers, and clustered environments.
• Install, configure, upgrade, patch, and monitor Splunk infrastructure.
• Onboard and troubleshoot data from servers, applications, network devices, security tools, cloud platforms, and databases.
• Manage indexes, retention, storage, licensing, users, roles, authentication, and access controls.
• Develop and maintain searches, dashboards, reports, alerts, and security monitoring use cases.
• Optimize search performance, system health, capacity, availability, and licensing.
• Integrate Splunk with security and enterprise platforms through APIs and automation.
• Support SOC investigations, incident response, compliance, and audits.

• 5+ years of experience with Splunk Enterprise
• Knowledge of Splunk architecture, distributed deployments, and configuration files.
• Experience administering Indexers, Search Heads, Forwarders, and Deployment Servers.
• Experience onboarding and troubleshooting diverse data sources.
• Strong analytical, troubleshooting, communication, and documentation skills., * Splunk Enterprise Certified Admin or Architect certification.
• Experience with Splunk Enterprise Security, Splunk SOAR, or Splunk Cloud.
• Experience with SIEM/SOC operations, cloud platforms, Kubernetes, or cybersecurity integrations.
• Knowledge of ITIL and enterprise change-management practices.

Core Competencies

• Splunk administration
• Data ingestion and log management
• SIEM and security monitoring
• Linux and network troubleshooting
• Automation and scripting
• Performance and capacity management
• Documentation and collaboration

PFFCUBO