Splunk Engineer/Architect

Responsibilities

• Design and deploy scalable, highly available Splunk architectures across on-prem, cloud, and hybrid environments.
• Lead Splunk engineering efforts including installation, configuration, upgrades, and ongoing platform maintenance (indexers, search heads, forwarders, clustering).
• Develop and execute data ingestion strategies, including onboarding, normalization, parsing, and performance optimization.
• Establish governance, platform standards, and best practices to ensure long-term scalability and reliability.
• Support SOC operations by building and tuning SIEM use cases, correlation searches, and alerts aligned with MITRE ATT&CK.
• Collaborate with cybersecurity and infrastructure teams to enhance threat detection, monitoring, and incident response capabilities.

Requirements

• Active Secret Clearance required.
• 5+ years of hands-on Splunk Engineering/Architecture experience (backend focus, not dashboarding).
• Strong expertise with Splunk Enterprise and Splunk Enterprise Security (ES) in large-scale environments.
• Deep understanding of data ingestion, indexing, clustering (indexer/search head), and search optimization.
• Experience supporting Splunk within a SOC and contributing to SIEM/security monitoring strategies.

Pay

$140,000-$180,000

Schedule

Onsite 5 days per week in RTP, NC

Benefits

• Health
• Vision
• Dental
• PTO
• Paid Holiday and Sick Leave if Required by Law