Systems Administrator - Splunk SME

Are you interested in using your skills to help shape the Cyber Security & Intel space If so look no further. Amentum is seeking a Systems Administrator - Splunk SME to join our team of passionate individuals at Fort Meade MD. In this role you will support challenging mission-critical projects that make a direct impact on the Nations security and intelligence mission.In support of DISA Amentums Intel and Cyber Division is expanding a proven team of highly skilled engineers and architects to support a program that provides critical IT capabilities to the Department of Defense. This team is committed to engineering assembling integrating deploying and sustaining an innovative IT enterprise solution.Our team delivers secure mission-critical capabilities where system integrity and rapid deployment are paramount. We are seeking a Systems Administrator - Splunk SME who combines meticulous technical discipline with strategic foresight. In this role you will lead efforts to establish and maintain robust baselines in a rapidly evolving operational environment. Success requires the ability to navigate complex unique technical challenges independently while fostering collaborative solutions across integrated teams. To excel you must possess a proactive learning mindset and the agility to rapidly master and govern the integration of next-generation systems and services.Work Schedule 8 Hours per day Monday thru FridayEssential Responsibilities The duties and responsibilities of the Systems Administrator - Splunk SME include but are not limited to the followingThe Senior Splunk Administrator is responsible for the design deployment operation and sustainment of enterprise Splunk platforms supporting log management security monitoring mission systems health and operational analytics across classified networks. This role serves as the technical authority for the Splunk environment ensuring availability data integrity performance and compliance with Intelligence Community IC security policy. The incumbent works closely with cybersecurity analysts system owners network engineers and mission customers to deliver trusted actionable data in support of the organizations mission.Key ResponsibilitiesInstall configure upgrade patch and maintain Splunk Enterprise and Enterprise Security ES components including indexers search heads heavy and universal forwarders deployment servers cluster managers license managers and monitoring consoles.Administer indexer clustering and search head clustering to meet availability retention and disaster recovery requirements.Plan capacity storage tiering and data retention hotwarmcoldfrozen based on ingest volumes search workloads and mission needs.Tune platform performance including search optimization data model acceleration and resource allocation.Operate in air-gapped and cross-domain environments including offline software and content transfers via approved procedures.Develop and manage data ingestion pipelines from diverse sources network devices operating systems applications security tools cloud services and custom mission systems.Create and maintain props transforms field extractions source types and Common Information Model CIM mappings to normalize data.Manage data quality forwarder health and ingest anomalies troubleshoot gaps and latency.Implement role-based access controls index-level segregation and need-to-know data compartmentation.Ensure the Splunk environment complies with applicable IC and DoD standards such as ICD 503 NIST SP 800-53 RMF and DISA STIGs.Support system authorization activities by producing and maintaining security documentation configuration baselines and evidence artifacts.Configure audit logging authentication e.g. PKICAC SAML LDAPAD integration and encryption of data in transit and at rest.Remediate vulnerabilities and implement findings from scans inspections and audits within required timelines.Build and maintain dashboards reports alerts correlation searches and Splunk appsadd-ons to support SOC insider threat system health and mission analytics use cases.Partner with analysts to translate operational requirements into SPL searches and detection logic.Support incident response by providing rapid search data retrieval and forensic timeline support.Automate administration and deployment tasks using scripting and configuration management e.g. Python Bash PowerShell Ansible.Maintain operational runbooks SOPs architecture diagrams and change management records.Provide Tier 3 escalation support and mentor junior administrators and analysts.Participate in change control boards technical working groups and design reviews brief leadership on platform status risks and roadmap.Evaluate emerging Splunk capabilities and recommend improvements to the enterprise logging and analytics strategy.Demonstrated expertise in indexer and search head clustering forwarder management and distributed Splunk architectures.Strong proficiency in Search Processing Language SPL regular expressions and data parsingnormalization.Experience working on classified or air-gapped networks.Solid Linux system administration skills RHELCentOS preferred working knowledge of Windows Server.Working knowledge of networking fundamentals TCPIP syslog DNS TLS and security concepts.Compliance with DoD 8140 IC workforce certification requirements such as Security CE or equivalent for the assigned work role obtained within the required timeframe.Prior experience in an IC DoD or other government cyber environment.Expert-level knowledge of Splunk architecture data lifecycle and performance tuning.Ability to analyze complex technical problems and deliver reliable solutions under mission-driven timelines.Strong written and verbal communication skills including the ability to explain technical concepts to non-technical leaders.Sound judgment in handling classified information and adherence to security protocols.Ability to work independently and collaboratively in a multi-disciplinary team environment.Commitment to documentation process discipline and continuous improvement.Mentor junior engineers and share technical knowledge across the teamWork Environment Physical Demands and Mental DemandsEmployee will work in a SCIF on a daily basis.Employee may also be required to work in a datacenter environment for specified periods of time.Security Clearance Required Must have active Top Secret clearance with SCI eligibilityMinimum Education Bachelors degree in Computer Science Information Systems Cybersecurity or a related field or equivalent experience additional years of relevant experience may substitute for education or equivalent professional experience typically 4 additional years in lieu of degree.Minimum Years of ExperienceExperience 8 years of progressive IT experience including 5 years administering Splunk Enterprise in a large-scale production environment.Experience working in accredited access-controlled or air-gapped environmentsRequired Certifications One or more of the followingSplunk Enterprise Certified ArchitectDoD 8570.01-M IAT-II baseline certification requirementsPreferred QualificationsSplunk Core Certified ConsultantExperience with Splunk Enterprise Security SOAR or ITSI.Experience supporting SOC cyber threat hunting or insider threat programs.undefinedExperience with configuration management and automation tools Ansible Git CICD pipelines.This position is designated as a safety sensitive position.As part of our commitment to maintaining a safe and compliant work environment Amentum is a drug-free workplace and requires all personnel to comply with company drug and alcohol policies as a condition of employment. Employment is contingent upon successful completion of the drug screening process. Please note that this may include pre-hire screening for marijuana as well as other federally controlled substances due to Amentums role as a federal contractor and trusted partner to the US Government.Other ResponsibilitiesSafety - Amentum enforces a safety culture whereby all employees have the responsibility for continuously developing and maintaining a safe work environment. As appropriate each employee is responsible for completing all training requirements and fulfilling all self-aidbuddy aid responsibilities participating in emergency response tasks and serving on safety committees and teams.Quality - Quality is the foundation for the management of our business and the keystone to our goal of customer satisfaction. It is our policy to consistently provide services that meet customer expectations. Accordingly each employee must conform to the Amentum Quality Policy and carry out job activities in compliance with applicable Amentum Quality System documents and customer contracts. Each employee must read and understand hisher Quality Management and Customer Satisfaction responsibilities.Procedure Compliance - Each employee must read understand and implement the general and specific operational safety quality and environmental requirements of all plans procedures and policies pertaining to hisher job. Qualified applicants will receive consideration for employment without regard to race color religion sex national origin sexual orientation gender identity disability or protected veteran status.javelin Compensation Details180k - 225k The compensation range or hourly rate listed for this position is provided as a good-faith estimate of what the company intends to offer for this role at the time this posting was issued. Actual compensation may vary based on factors such as job responsibilities education experience skills internal equity market data applicable collective bargaining agreements and relevant laws.Benefits OverviewOur health and welfare benefits are designed to support you and your priorities. Offerings includeHealth dental and vision insurancePaid time off and holidaysRetirement benefits including 401k matchingEducational reimbursementParental leaveEmployee stock purchase planTax-saving optionsDisability and life insurancePet insuranceNote Benefits may vary based on employment type location and applicable agreements. Positions governed by a Collective Bargaining Agreement CBA the McNamara-OHara Service Contract Act SCA or other employment contracts may include different provisionsbenefits. Original Posting11122026 - Until FilledAmentum anticipates this job requisition will remain open for at least three days with a closing date no earlier than three days after the original posting. This timeline may change based on business needs. Amentum is proud to be an Equal Opportunity Employer. Our hiring practices provide equal opportunity for employment without regard to race sex sexual orientation pregnancy including pregnancy childbirth breastfeeding or medical conditions related to pregnancy childbirth or breastfeeding age ancestry United States military or veteran status color religion creed marital or domestic partner status medical condition genetic information national origin citizenship status low-income status or mental or physical disability so long as the essential functions of the job can be performed with or without reasonable accommodation or any other protected category under federal state or local law. Learn more about your rights under Federal laws and supplemental language atLabor Laws Posters.