Splunk Engineer

Splunk Engineer The Information Security Engineering team is looking for a Splunk Engineer to manage, optimize, and enhance our Splunk environment. In this role, you'll play a critical part in our enterprise security initiatives by developing dashboards, integrating logs, and ensuring our Splunk platform is performing at its best. If you're a proactive problem-solver with strong Splunk, AWS, and Python skills, we want to hear from you. What You'll Bring: ● Experience: Proven experience as a Splunk Administrator and Developer. You should be comfortable with both the administrative and development aspects of the Splunk platform. ● Troubleshooting: Strong problem-solving skills with the ability to diagnose and resolve complex Splunk issues. ● Cloud: Solid understanding of AWS and experience integrating AWS services like CloudTrail, CloudWatch, and S3 with Splunk. ● Scripting: Proficiency in Python for automating Splunk tasks, data enrichment, and API integrations. ● Security: A deep understanding of enterprise security concepts and experience using Splunk for threat detection and incident response. Troubleshooting & Optimization ● Diagnose and resolve complex Splunk issues related to performance, search, and indexing. ● Monitor Splunk's health and proactively implement solutions to improve system reliability and uptime. ● Performance Tune the environment by optimizing search queries, improving indexing strategies, and enhancing data ingestion processes. Dashboard & Analytics ● Develop and implement custom Splunk dashboards and visualizations that translate complex data into clear, actionable insights for security and business stakeholders. ● Collaborate with teams to understand their requirements and build dashboards that address specific security and operational needs. Enterprise Security & Threat Detection ● Leverage Splunk Enterprise Security (ES) to build and maintain threat detection and incident response capabilities. ● Create and fine-tune correlation searches and risk-based alerts to identify and respond to security threats effectively Log Integration ● Onboard and integrate logs from a wide range of sources, including servers, cloud platforms (AWS), applications, and security tools. ● Normalize and parse raw data using props.conf and transforms.conf to ensure consistency and usability.