About this role

Architect, operate, and optimize a distributed, large-scale Splunk environment
Lead capacity planning, index design, data retention strategies, and SmartStore lifecycle management
Maintain high availability, scaling, and resilience across multi-site deployments
Collaborate with SOC, Incident Response, and Threat Hunting teams to ensure high-quality security log ingestion
Onboard and normalize logs from firewalls, EDR, identity platforms, cloud providers, network telemetry, and custom applications
Develop and optimize detection content
Build and manage ingestion pipelines, parsing, field extractions, CIM compliance, HEC configurations, and forwarder architecture

5+ years experience administering large Splunk Enterprise or Splunk Cloud environments
Strong hands-on knowledge of: Indexer clustering, search head clustering SmartStore / S3-compatible object store design Universal/heavy forwarder architecture
Deep experience with security log ingestion and SIEM use cases
Strong SPL expertise, including: Search optimization Summary indexing / data model acceleration CIM mapping and field normalization
Experience with Linux systems engineering, scripting (Python/Bash), and automation frameworks (Ansible, Terraform, GitOps preferred)

Senior Engineer

Key skills