Splunk Engineer

Job highlights

• Configure and maintain Indexers,Search Heads,Forwarders,Deployment Server,Cluster Master

Job Summary

Role Summary: We are seeking an experienced Senior Splunk Administrator responsible for deployment, configuration, optimization, and ongoing management of the Splunk environment, including SIEM use case development and automation support for SOC operations.

Responsibilities

• Install, configure, and manage Splunk Enterprise / Splunk ES (Standalone, Distributed, Clustered).
• Configure and maintain Indexers, Search Heads, Forwarders, Deployment Server, Cluster Master.
• Onboard and integrate logs from servers, network devices, security tools, endpoints, and cloud platforms.
• Perform use case creation, correlation rule development, and fine-tuning aligned with MITRE ATTCK framework.
• Optimize detection logic to reduce false positives and improve alert quality.
• Develop and maintain dashboards, alerts, reports, and advanced SPL queries.
• Support SOAR playbook development and automation workflows for incident response (phishing, malware, ransomware, etc.).
• Monitor Splunk platform health, performance tuning, EPS optimization, and storage management.
• Troubleshoot ingestion, parsing (props.conf, transforms.conf), and search performance issues.
• Implement RBAC, data retention policies, and security hardening.
• Support version upgrades, patching, backup, and DR setup.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.