> Markdown version of [/jobs/ext/4675671-splunk-engineer-2](https://www.wearedevelopers.com/jobs/ext/4675671-splunk-engineer-2). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Splunk Engineer 2

- **Company:** CATAPULT STAFFING LLC
- **Location:** Arlington, VA, United States
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Microsoft Azure, Linux System Administration, Role-Based Access Control, Azure Active Directory, Syslog, Extensible Markup Language (XML), Data Ingestion, Cyber Threat Analysis, Data Layers, Splunk
- **Published:** November 11, 2026
- **Apply:** https://www.clearancejobs.com/jobs/9308227/splunk-engineer-2

## About the Role

Remote (must be local to DC area incase customers need onsite support)
Must be US citizen with TS/SCI Eligibility, o Splunk certifications (Core Consultant, ES Admin, ITSI Admin, Enterprise Architect)
o Cribl experience (excluded now, likely future scope)
o Azure and Microsoft Entra ID administration depth
o DISA STIG/OS hardening and NIST SP 800-53 / RMF / ATO literacy
o Federal delivery at large scale (~10,000 users)

## Description

A hands-on senior Splunk consultant who can architect and build the platform, engineer the data layer, and stand-up Enterprise Security Premier, ITSI, and UEBA, while producing client facing documentation / cross train / manage scoping.

Must Have Skills:
o Experience deploying Splunk ITSI, UEBA, ES Premier
o Splunk Enterprise 10.x architecture: multisite indexer clustering and search head clustering
o SmartStore on Azure Hot Blob, plus Azure Archive Blob (GRS) for immutable backup
o Index design and retention strategy (per-index, 30-month hot tier, set at build)
o Deployment server, forwarder management, and Universal Forwarders at scale
o Monitoring Console, RBAC, TLS/certificates, Linux administration, syslog (rsyslog/syslog-ng)
o Data onboarding and CIM normalization (hard prerequisite for ES/UEBA)
o SplunkBase TA deployment and data model design/acceleration
o ITSI: install, KPIs/services/entities, content packs, event analytics (correlation searches, NEAPs, glass tables)
o Enterprise Security Premier: install/config, Assets & Identities against Microsoft Entra ID/AD, use-case library, threat intel, Risk-Based Alerting
o ES-embedded UEBA: configuration, identity/asset enrichment, 4-week baseline and tuning
o Expert SPL and private app/TA development (Simple XML and Dashboard Studio)
o Clear technical writing (gap analyses, mapping documents, readiness summaries)