Splunk SME

Key Responsibilities:

• Design, implement, and manage Splunk environments, ensuring optimal performance, availability, and scalability.
• Develop custom dashboards, reports, and alerts based on business and security requirements, optimizing searches and queries for efficiency.
• Integrate data from various sources into Splunk, ensuring proper parsing, normalization, and indexing.
• Utilize Splunk for security monitoring, threat detection, and incident response in collaboration with security teams.
• Provide technical guidance, training, and mentorship to junior team members on best practices and Splunk usage.

Required Qualifications:

• Bachelor's degree in Computer Science, Information Technology, Engineering, or related field (or equivalent experience).
• Minimum of 3 years of hands-on experience with Splunk, including architecture, configuration, and administration.
• In-depth understanding of Splunk components (indexers, search heads, forwarders, etc.), Splunk Cloud, and Splunk Enterprise Security (ES).
• Strong experience in data parsing, creating Splunk queries (SPL), and optimizing searches.
• Expertise in Splunk integrations with other systems (e.g., SIEM, networking, security devices).
• Familiarity with scripting and automation using Python, Bash, or other languages to enhance Splunk operations.
• Solid understanding of security and networking concepts.

Preferred Qualifications:

• Splunk Certified Admin and/or Splunk Certified Architect certification(s).
• Experience with Splunk’s Machine Learning Toolkit and advanced data analytics features.
• Experience in cloud technologies such as AWS, Azure, or GCP and integrating them with Splunk.
• Knowledge of security compliance standards (e.g., PCI-DSS, HIPAA, GDPR) and leveraging Splunk to meet those standards.
• Experience with automated deployment tools (e.g., Ansible, Puppet, Chef).
• Strong communication skills, with the ability to explain complex technical concepts to non-technical stakeholders.