We are seeking a skilled and experienced Splunk Architect to design, implement, and manage enterprise-scale Splunk solutions across cloud and on-prem environments. The ideal candidate will have a deep understanding of Splunk architecture and be capable of leading deployment strategies, data onboarding, and integrations in a complex IT environment.
Key Responsibilities:
- Design and implement scalable, resilient, and secure Splunk Enterprise and Splunk ES/ITSI architectures.
- Lead Splunk infrastructure planning, upgrades, and clustering strategies.
- Onboard and normalize logs from systems including Windows, Linux, firewalls, cloud services (AWS/Azure/GCP), and application logs.
- Develop dashboards, alerts, reports, and KPIs for IT operations, SOC teams, and business stakeholders.
- Integrate Splunk with third-party tools (e.g., ServiceNow, Jira, AWS CloudWatch, SOAR tools).
- Perform system tuning, data retention strategy planning, and storage management.
- Define and implement correlation rules, SPL queries, and CIM-compliant data models.
- Provide architectural consulting to internal teams and mentor junior engineers.
- Ensure best practices for security monitoring, compliance, and incident response workflows.
Required Skills & Qualifications:
- Bachelor's or Master's degree in Computer Science, IT, or related field.
- 7+ years of IT experience, with 5+ years of hands-on Splunk experience.
- Expertise in:
- Splunk deployment architecture (Indexer clusters, Search Head clusters, Heavy Forwarders, Deployment Servers)
- SPL (Search Processing Language)
- CIM and data onboarding
- Security and compliance use cases (e.g., SOC, NIST, GDPR, ISO 27001)
- Experience with cloud platforms: AWS, Azure, or GCP.
- Strong knowledge of regex, data parsing, Linux/Unix, and networking protocols.
- Automation/scripting experience with Python, Shell, or Ansible preferred.
Certifications (Preferred):
- Splunk Certified Architect
- Splunk Certified Admin
- Splunk Enterprise Security Certified
- Any relevant cloud certifications (AWS/Azure)