Splunk Engineer

Key
Responsibilities

• Administer and maintain Splunk Enterprise
  Security (ES) environment.
  
• Manage index lifecycle, retention policies, and
  storage optimization
  

• Develop, optimize, and maintain correlation
  searches and use cases
  
• Align detections with frameworks like MITRE
  ATT&CK
  
• Create and enhance Splunk dashboards, reports,
  and alerts
  
• Integrate new log sources and data inputs (cloud,
  network, endpoint, apps)
  
• Normalize and onboard logs using CIM (Common
  Information Model)
  
• Tune Data Models, tags, event types
  

• Provide advanced support for incident
  investigations escalated from L1/L2
  
• Conduct deep forensic analysis using Splunk data
  
• Support incident response activities and root
  cause analysis
  
• Work closely with SOC analysts to improve
  detection and response workflows
  

• Integrate Splunk with SOAR platforms
  
• Support API integrations with external security
  tools
  

• Investigate issues with Data
  Ingestion/latency/inputs
  
• Optimize queries and reduce search execution time
  

• Maintain Splunk architecture documentation and
  SOPs
  
• Support audits and reporting requirements
  
• Conduct knowledge sharing and training for L1/L2
  analysts
  

Technical
Skills Required

Splunk
Expertise

• Strong hands -on experience
  with:
  
• Splunk Enterprise Security
  (ES)