Designation: Assistant Manager
Experience: 5 to 10 years
Location: Chennai, Tamil Nadu, India (CHN)
Job Description:
Splunk Data Governance & Engineering Specialist
Key Responsibilities:
Data Source Inventory & Analysis
Build and maintain a master inventory of Splunk log sources (owner, ingestion path, volume, use case, retention).
Audit ingestion vs. usage; identify redundant/noisy data sources.
Flag low-value data for removal, archiving, or downsampling.
Governance Framework & Standards
Define ownership, classification, and schema standards across all Splunk sources.
Enforce consistent retention and lifecycle management policies.
Normalize high-value log sources to OCSF/ECS/Splunk CIM standards.
Apply tagging and metadata for sensitivity, retention, and business use cases.
Ingestion & Transformation Controls
Filter noisy/heartbeat events before ingest.
Apply field renaming, enrichment, and transformation pipelines.
Ensure metadata (owner, system, retention) is automatically attached at ingest.
Data Quality & Monitoring
Build dashboards for field completeness, timestamp accuracy, and event health.
Automate enforcement of retention checks and ingestion anomaly detection.
Run periodic governance reviews to ensure sources stay aligned with standards.
Operational Impact
Improve Splunk query performance and detection accuracy.
Reduce storage costs by enforcing governance and pruning unused data.
Establish sustainable governance through automation and oversight.
Responsibilities:
Strong hands-on experience with Splunk Enterprise and Splunk Enterprise Security (ES).
Proficiency in SPL for advanced queries, performance tuning, and dashboards.
Knowledge of indexer/search head clustering, forwarder management, data models, and knowledge objects (macros, lookups, field extractions).
Experience with Splunk CIM and mapping log sources to normalized schemas.
Familiarity with data models, accelerations, summary indexing, and performance tuning at scale.
Data Governance & Security
Experience defining log source ownership, classification, and retention frameworks.
Strong understanding of RBAC in Splunk (roles, capabilities, scoping by indexes and apps).
Ability to create governance policies for onboarding, lifecycle management, and access control
Data Engineering & Automation
Experience with data ingestion and parsing in Splunk (forwarders, HEC, API-based inputs).
Strong skills in log transformation/enrichment (field parsing, timestamp correction, renaming, metadata tagging).
Scripting in Python, Bash, or PowerShell for automation of Splunk admin and governance tasks.
4–7 years of Splunk engineering/administration experience, ideally in large-scale enterprise security environments.
Prior experience cleaning up data sprawl in SIEM or Splunk environments.
Strong analytical and problem-solving mindset; comfortable in fast-paced, dynamic settings.
Bonus: Security knowledge (SIEM/UEBA use cases, detection tuning, MITRE ATT&CK alignment).
Skills:
5 to 10 years in the Splunk Enterprise domain
Splunk Enterprise and Splunk Enterprise Security, Security knowledge (SIEM/UEBA use cases, detection tuning, MITRE ATT&CK alignment).
We are an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, colour, national origin, sex, gender, gender expression, sexual orientation, age, marital status, veteran status, or disability status.