Cyber Security Splunk Administrator

The Splunk Administrator is responsible for supporting the activities related to implementation, configuration, management, and maintenance of a Splunk Cloud, Splunk Enterprise Security, and additional logging-related security platforms and functions. The Splunk Administrator will have demonstrable experience and expertise in managing a large Splunk Enterprise or Splunk Cloud environment.  The Splunk Administrator is a technology and process focused security professional with an emphasis in information security, secure system implementation, and maintenance. The Splunk Administrator will review, assess, recommend, and implement technical controls to ensure the Splunk environment and related security platforms are well managed and resilient. The Splunk Administrator will also ensure that routine maintenance and configuration management are well maintained and assist the Splunk Team Lead as required.   
 
What you'll do:

• Management, upkeep, and expansion/design of a complex deployment. 

• Administer all aspects of Splunk event collection and forwarding. 

• Administer Splunk Cloud and Enterprise Security. To include index, source type, field, CIM compliance, ES (Enterprise Security) use cases and SPL upkeep.

• Configure and manage props and transforms for typical and proprietary data 

• Implement Security and Business use-cases in the Splunk framework. 

• Manage syslog configurations and forwarding with syslog-ng or SC4S. 

• Create custom dashboards, reports, and alerts within Splunk. 

• Ability to create complex Splunk queries in SPL and XML for reports and dashboards 

• Ability to troubleshoot and optimize SPL for large queries or data sets with strong knowledge of the Splunk search pipeline 

• Understanding and implementation of log data flows between source systems and Splunk components 

• Ability to write applications that pull data from a source system for writing to Splunk (Python preferred) 

• Ability to create custom field extractions, TA’s and source types 
   

What you'll bring:

• 5 years of direct administration experience with Splunk Cloud, Splunk Enterprise or Enterprise Security environment 

• 3 years designing, engineering and securing complex infrastructure architectures. 

• 1 years working in a cyber security org or team (preferably Security Operations). 

• Cloud experience with getting data in (Lambda functions, Kinesis Firehose, or other push methodologies to get higher volumes of data into Splunk from cloud subscriptions) 

• Direct experience with development or deployment in the cloud (AWS, Azure, GCP) 

• Comfortable with tooling that demonstrates an automation mindset: Chef, Puppet, Ansible, CI/CD experience, and can provide examples. 

• Experience with Windows and Linux administration and bash, Python, or Ruby scripting. 

• Experience with implementing best practices regarding event collection and logging in cloud infrastructure and cloud services. 

• Experience in log management on different tiers of infrastructure and platform services. 

• Experience working with containerized and serverless computing platforms. 

• Experience in secrets management, encryption technologies, and key management. 

• Splunk certified Administrator or Architect certification is preferred 

• Regulatory Compliance Experience