Splunk Technical Lead – Enterprise Security & Platform
Dallas, TX
Splunk Enterprise & Splunk Enterprise Security (ES)
Splunk SPL / Data Analytics
Python / Bash Scripting & Automation
Have you personally administered Splunk Enterprise Security (ES), including data onboarding, normalization, CIM mapping, and security content?
Have you performed Splunk platform upgrades, migrations, infrastructure refreshes, or major version changes in an enterprise environment?
Have you designed or supported Splunk architecture involving indexers, search heads, forwarders, clustering, and high availability?
The Consultant will provide technical consulting services supporting the administration, architecture, engineering, integration, optimization, and ongoing operation of the client's Splunk Enterprise Platform and Splunk Enterprise Security (ES) environment.
Services will include administration and configuration of Splunk infrastructure; onboarding and integration of enterprise data sources; log ingestion, parsing, normalization, indexing, and data management; performance monitoring and tuning; and development and maintenance of Splunk applications, dashboards, data models, searches, reports, alerts, and security/compliance content.
The Consultant will provide technical leadership related to Splunk platform architecture, infrastructure standards, upgrades, refreshes, migrations, and lifecycle management. Services may include evaluation and implementation of platform upgrades or infrastructure changes designed to improve scalability, availability, security, reliability, and performance.
The Consultant will develop and maintain Splunk integrations and custom solutions utilizing technologies including Splunk SPL, Python, Bash, SimpleXML and, where applicable, JavaScript and CSS. The Consultant will also support integrations between Splunk and business-critical enterprise applications, security platforms, cloud environments, and other observability or monitoring technologies.
Additional services may include supporting enterprise-scale observability platform migrations, assisting with CI/CD and automated deployment practices, troubleshooting production issues, documenting architecture and operational procedures, providing technical recommendations, and mentoring or providing technical guidance to other team members.
Services may be performed remotely, with preference for resources located near Dallas, Texas or Redmond, Washington.
Deliverables
Administration, configuration, maintenance, and technical support of the Splunk Enterprise and Splunk Enterprise Security platforms.
Successful onboarding and integration of assigned enterprise applications, systems, infrastructure, and log/data sources into Splunk.
Configuration and optimization of log ingestion, parsing, normalization, indexing, retention, search performance, and data-management processes.
Development, enhancement, and maintenance of Splunk searches, alerts, dashboards, reports, data models, applications, add-ons, and security/compliance content.
Development and maintenance of custom Splunk solutions and automation using SPL, Python, Bash, SimpleXML and other applicable technologies.
Technical recommendations and implementation support related to Splunk architecture, infrastructure standards, capacity, performance, scalability, high availability, upgrades, platform refreshes, and lifecycle management.
Support for Splunk integrations with business-critical enterprise applications, cloud platforms, security technologies, and observability systems.
Technical support for platform migrations, upgrades, deployment automation, CI/CD processes, and infrastructure modernization activities as assigned.
Troubleshooting, root-cause analysis, and resolution recommendations for Splunk platform, ingestion, integration, performance, and production-support issues.
Technical documentation covering configurations, architecture, integrations, deployment procedures, operational processes, troubleshooting procedures, and implemented solutions.
Knowledge transfer, technical guidance, and mentoring to client and project team members regarding Splunk administration, engineering, architecture, and operational best practices.
Services and deliverables will be considered acceptable when:
Assigned Splunk platform administration, configuration, engineering, and support activities are completed in accordance with client requirements, established technical standards, and agreed project priorities.
Assigned data sources and enterprise systems are successfully integrated into Splunk with data being properly ingested, parsed, normalized, indexed, searchable, and available for the intended operational, security, or analytical use.
Developed or modified searches, dashboards, alerts, reports, data models, applications, add-ons, and security/compliance content operate as intended and satisfy documented functional requirements.
Platform upgrades, infrastructure changes, migrations, and configuration modifications are implemented successfully without unresolved material impact to platform availability, reliability, security, or performance.
Splunk platform performance and ingestion-related issues assigned to the Consultant are investigated and appropriately resolved, mitigated, or documented with actionable technical recommendations.
Custom scripts, integrations, automation, and Splunk application components function according to agreed requirements and applicable client development and security standards.
Technical solutions support applicable production requirements for availability, reliability, scalability, performance, monitoring, logging, and operational support.
Required technical documentation is sufficiently complete and accurate to support ongoing administration, maintenance, troubleshooting, and knowledge transfer.
Knowledge-transfer activities and technical guidance are provided as reasonably requested to enable designated client or project personnel to understand and support implemented solutions.
Deliverables are reviewed and accepted by the designated client or project representative and any identified deficiencies are corrected within a mutually agreed timeframe.