Job Title: Splunk & Cribl Platform Engineer IV
Work Arrangement: Hybrid (4 days onsite / 1 day remote for the first 6 months, then 3 days onsite / 2 days remote after)
Location: Richmond, VA / Charlotte, NC / Pennington, NJ (local candidates only)
Employment Type: Contract, 12+ Months
Engagement Type: W2 only; must be authorized to work in the US without employer sponsorship, now or in the future
Final Interview: 2 virtual rounds; onsite interview may also be requested
Position Summary
Dhaka Technologies Limited Company (DTLC) is hiring a Splunk & Cribl Platform Engineer IV on behalf of its client, i8is, for end client Bank of America.
The client is hiring a senior Splunk and Cribl platform engineer to support a large-scale, highly distributed Splunk Enterprise and Splunk Cloud environment that directly feeds the bank's Information Security and SOC teams. This is a production ownership role, not a monitoring or dashboard-building role.
What You'll Do
Splunk Platform Operations and Production Stability
- Own end-to-end production support for search head clusters, indexer clusters, deployers, deployment servers, and forwarders
- Ensure high availability, performance, and resiliency for security and operational use cases
- Lead incident response, troubleshooting, root cause analysis, and service restoration for Splunk and Cribl
- Proactively identify risks, capacity constraints, and performance bottlenecks, implement preventive and tuning measures
Security Log Ingestion and SIEM Enablement
- Serve as a key technical enabler for Information Security and SOC teams
- Onboard and normalize new data sources, supporting CIM compliance and field normalization
- Tune ingestion pipelines using props.conf and transforms.conf
- Build and support dashboards, searches, and alerts for threat detection and investigations
Cribl Data Pipeline Management
- Administer and support Cribl for data routing, filtering, enrichment, and cost optimization
- Ensure data integrity, reliability, and performance across ingestion pipelines
- Collaborate with architecture teams on data flow strategies and onboarding standards
Governance, Documentation, Compliance
- Develop and maintain runbooks, SOPs, installation guides, and operational documentation
- Adhere to change management, incident management, and SLA commitments
Must-Have Qualifications
- 5+ years hands-on administering large-scale Splunk Enterprise or Splunk Cloud
- Real platform admin experience, not dashboard or alert building for other applications, fastest screen-out
- Indexer clustering and search head clustering
- Universal and heavy forwarder architectures
- SmartStore / S3-compatible object storage
- SPL, search optimization, summary indexing, data model acceleration
- Deep experience with security log ingestion and SIEM use cases
- Proven ability to lead production incidents, perform RCA, drive preventive solutions
- Strong Linux administration
- Cribl administration (data routing, filtering, enrichment), required, not a nice-to-have
- Excellent written and verbal communication, able to engage senior stakeholders
Desired Skills
- Splunk certifications (Enterprise Admin or Enterprise Architect)
- Splunk ES and SOAR experience (Phantom or equivalent, general exposure fine)
- Cloud logging/security architecture exposure (AWS, Azure, GCP)
- RHEL and Windows Server administration
- Monitoring, APM, event management tool experience
- Strong understanding of security, network, system, and database operations
- Ability to balance multiple priorities in a fast-paced environment
What Success Looks Like
- Manage cluster-level issues end to end
- Deep-dive data flow and ingestion issues
- Onboard and normalize new data sources for InfoSec/SOC use
- Operate calmly during high-severity incidents
- Own runbooks, SOPs, audit-ready documentation
How to Apply
Interested candidates, or anyone referring a qualified professional, may send an updated resume to talent@dhakatech.us with the subject line "Splunk & Cribl Platform Engineer IV".