Own and support a large-scale Splunk Enterprise or Splunk Cloud environment, ensuring platform availability, scalability, reliability, and performance. Partner with security, SOC, architecture, engineering, and operations teams to manage security log ingestion, SIEM operations, production incidents, and platform stability in a hybrid, mission-critical environment.
Responsibilities
- Administer and maintain large-scale Splunk Enterprise or Splunk Cloud environments.
- Ensure the availability, scalability, reliability, and performance of Splunk infrastructure.
- Manage search head and indexer clustering, forwarders, applications, and configurations.
- Support security log ingestion and SIEM operations in partnership with security and SOC teams.
- Troubleshoot production incidents, conduct root cause analysis, and manage problems.
- Optimize searches, summary indexing, data model acceleration, and platform stability.
Required Skills
- Splunk Enterprise
- Splunk Cloud
- Search Head Clustering
- Indexer Clustering
- Universal Forwarders
- Heavy Forwarders
- Search Processing Language (SPL)
- Search Optimization
- Summary Indexing
- Linux Administration