Lead Engineer, IT Security (SIEM/Splunk)

Responsibilities

• Lead the architecture, engineering, administration, and ongoing optimization of Splunk Cloud across a large-scale, distributed, hybrid environment
• Responsible for Splunk Cloud platform health, including indexer/search head clustering, deployment servers, forwarder management, storage optimization, license utilization, retention policies, performance tuning, and system availability
• Develop, tune, and maintain Splunk content, including dashboards, reports, alerts, correlation searches, data models, field extractions, props/transforms, lookups, macros, and CIM-aligned knowledge objects
• Lead automation initiatives across Splunk and security operations, including automated log onboarding, health checks, evidence collection, and ticket creation
• Work with SOAR platforms, scripting, APIs, CI/CD pipelines, and infrastructure-as-code practices to automate repeatable Splunk administration, content management, and operational workflows
• Troubleshoot complex Splunk issues related to ingestion, parsing, indexing, searching, acceleration, dashboards, apps/add-ons, authentication, integrations, storage, and platform performance
• Partners closely with security operations, threat detection, incident response, infrastructure, cloud, and application teams to ensure reliable log ingestion, scalable platform performance, actionable detections, and continuous improvement through automation, analytics, and AI-assisted capabilities

Requirements

General Experience:

• 3 to 6 years of related experience in Splunk engineering, administration, and content development
• System administrator experience in Linux, Windows, or OSX operating systems
• System administrator experience in maintenance and management of enterprise syslog environment
• Knowledge of networking and the common network protocols
• Experience with development of complex Splunk analytics
• Familiarity with interacting with a variety of APIs and using an API platform such as Postman, Insomnia, or Hopscotch to develop and test data integrations
• Demonstrated ability to create complex scripts, develop tools, or automate processes in PowerShell, Python or Bash

Skills

• B.S. in Computer Science, Computer Engineering, or related degree
• One or more of the following certifications or the ability to obtain within 1 year:
• Splunk Cloud Certified Admin
• Splunk Certified Architect
• Splunk Certified Consultant
• CISSP: Certified Information Systems Security Professional
• CCNA: Cisco Certified Network Associate

Qualifications

Bachelor’s, High School (HS)

Benefits

• Medical, dental, and vision insurance
• Life insurance, critical illness insurance, and accident insurance
• Disability benefits
• Retail savings plan
• Paid time off (including vacation, holidays, and sick leave)
• Parental leave