Engineer

Sr SIEM Admin - Splunk

Location:

As discussed over call, please find Details below :

About NI

Network Intelligence, incorporated in 2001, is a committed and well-recognized provider of services, solutions and products in the cybersecurity space. Our team of nearly 400 professionals have made a mark for themselves with highly satisfied clients all across the globe supported by our offices in New York, Dubai, Mumbai, Delhi and Pune. With a strong focus on research and innovation, we have built extensive capability around Big Data for Security Analytics, Red Team Assessments, Incident Response, and Security Automation. We have a strong culture of lifelong learning, research and mentoring. We encourage all our employees to constantly explore their boundaries, attend training programs, obtain certifications and participate in the research efforts of the global cybersecurity community.

Splunk Admin Roles and Responsibilities

1. Monitoring & Alerting

• Monitor Splunk dashboards for system health and performance.
• Review alerts and logs to identify potential issues.
• Escalate critical alerts or outages to appropriate teams.

2. Basic Troubleshooting

• Handle initial triage of issues like:
• Data not appearing in Splunk.
• Search slowness (basic checks only).
• User access issues.
• Restart forwarders or services (with guidance).

3. User Management

• Create, modify, or disable user accounts.
• Assign roles and permissions based on documented standards.
• Help users with login or access problems.

4. Data Onboarding Support

• Verify if data is reaching Splunk from known sources.
• Perform initial validation of inputs (file locations, log paths).
• Assist in maintaining a list of data sources and their status.

5. Routine Maintenance

• Check disk usage, index status, and licensing info.
• Run health checks using Splunk Monitoring Console.
• Support backup and archiving procedures as instructed.

6. Documentation & Reporting

• Maintain daily activity logs and shift handover notes.
• Update basic troubleshooting SOPs and guides.
• Report trends or repeated issues to L2 team.

7. Collaboration

• Work with L2/L3 admins, developers, and helpdesk staff.
• Participate in regular status or shift change meetings.
• Raise tickets and update incident tracking tools (like ServiceNow, Jira).

Skills Required for Splunk Admin

• Basic knowledge of Splunk architecture (indexers, forwarders, search heads).
• Familiarity with Splunk Web interface and simple SPL (Search Processing Language).
• Understanding of Linux/Windows basics.
• Communication skills to document and escalate effectively.
• Awareness of common log file locations and formats (syslog, .log, etc.).