Lead Splunk Architect

Role Overview

• Define and architect enterprise Splunk architecture supporting high availability, scalability, resilience, disaster recovery, and long-term growth
• Design and oversee distributed Splunk environments including: Indexer Clusters, Search Head Clusters, Deployment Servers, Cluster Managers, Heavy Forwarders, Universal Forwarders, License Management, Splunk Cloud and Hybrid architectures
• Develop technical roadmaps, modernization strategies, migration plans, and platform lifecycle recommendations
• Evaluate current platform capabilities and recommend architectural improvements supporting SOC operations and enterprise cybersecurity initiatives
• Serve as the technical lead for all Splunk engineering activities
• Provide mentorship and technical direction to Splunk Engineers, Security Engineers, Detection Engineers, and SOC Analysts
• Review architecture, engineering designs, implementation plans, dashboards, searches, integrations, and custom applications
• Establish engineering standards and best practices across index naming, Sourcetypes, CIM compliance, field extractions, knowledge objects, configuration management, change control, application lifecycle management, role-based access control
• Architect scalable and resilient Splunk infrastructure supporting enterprise data volumes
• Lead platform optimization including Search performance, Index performance, Storage management, Retention policies, License utilization, Data lifecycle management, Search concurrency, Data Model Acceleration
• Guide upgrades, patching, backup, disaster recovery, and high availability planning
• Lead troubleshooting of complex ingestion, parsing, indexing, search, and performance issues
• Define enterprise data onboarding strategies across security, infrastructure, cloud, identity, endpoint, network, and application data sources
• Oversee parsing, routing, index design, field extraction, source normalization, CIM implementation, retention policies, data quality
• Lead integrations with firewalls, IDS/ IPS, EDR, NDR, Identity providers, Cloud platforms, Vulnerability management, Ticketing systems, SIEM and SOAR technologies, Threat Intelligence platforms
• Architect Splunk capabilities supporting Threat Detection, Threat Hunting, Incident Response, Security Monitoring, Risk-Based Alerting, Compliance Reporting
• Guide development of Correlation Searches, Dashboards, Reports, Data Models, Detection Content, Enterprise Security Content
• Improve detection fidelity while reducing false positives
• Ensure Splunk capabilities support rapid investigation, evidence collection, event reconstruction, and executive reporting
• Architect automation strategies using Splunk SOAR
• Design and oversee playbooks for Incident enrichment, IOC validation, Threat intelligence lookups, Malware analysis, Case management, Automated containment, Notification workflows
• Integrate SOAR with enterprise security technologies using Python, REST APIs, and supported applications
• Establish automation governance and reusable orchestration standards
• Establish engineering governance for Configuration Management, App Lifecycle, Knowledge Object Management, Detection Content, Source Onboarding, Dashboard Standards
• Review deployment packages and engineering deliverables prior to production release
• Ensure engineering activities comply with change management, testing, documentation, rollback, and operational readiness requirements
• Serve as the primary technical advisor for Splunk architecture and platform strategy
• Communicate technical risks, roadmap priorities, and architectural recommendations to executive leadership and program stakeholders
• Translate business and mission requirements into scalable technical solutions
• Coordinate activities with infrastructure, cloud, networking, identity, cybersecurity, and vendor teams
• Develop and maintain Architecture diagrams, Engineering standards, Technical designs, Runbooks, Standard Operating Procedures, Disaster Recovery documentation, Knowledge Base articles, Technical decision records
• Evaluate emerging Splunk capabilities and recommend improvements to maximize platform value
• Foster engineering excellence through mentorship, standards, and continuous process improvement

Requirements

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or related field; equivalent professional experience may be substituted.
• 8+ years of enterprise Splunk administration and engineering experience
• 5+ years designing enterprise-scale distributed Splunk environments
• Experience leading Splunk Enterprise Security implementations
• Experience with Splunk Cloud and hybrid architectures
• Experience supporting Security Operations Centers (SOC)
• Experience leading technical teams and architecture initiatives
• Experience with enterprise cybersecurity monitoring and incident response
• Active security clearance strongly preferred (Public Trust or higher)
• CERTIFICATIONS: Required: Splunk Enterprise Certified Architect
• Preferred: Splunk Enterprise Security Certified Admin; Splunk Core Certified Consultant; Splunk SOAR Certified Automation Developer; CISSP; GIAC (GCIA, GCIH, or GCED); AWS, Azure, or Google Cloud certifications

Tech Stack

• AWS
• Azure
• Cloud
• Cyber Security
• Firewalls
• Python
• Splunk

Benefits

• Remote schedule with availability for some related travel (0%-25%)