About Gruve Gruve is an innovative software services startup dedicated to transforming enterprises to AI powerhouses. We specialize in cybersecurity, customer experience, cloud infrastructure, and advanced technologies such as Large Language Models (LLMs). Our mission is to assist our customers in their business strategies utilizing their data to make more intelligent decisions. As a well-funded early-stage startup, Gruve offers a dynamic environment with strong customer and partner networks. About The Role We are looking for a highly skilled SIEM Consultant with deep hands-on experience in designing, implementing, and configuring Splunk SIEM solutions. The ideal candidate will be responsible for deploying Splunk into customer environments, onboarding diverse log sources, configuring security use cases, and integrating external tools for end-to-end threat visibility. This role demands strong technical expertise, project delivery experience, and the ability to translate security monitoring requirements into Splunk configurations and dashboards. Key Responsibilities SIEM Design s Implementation Lead the design and deployment of Splunk architecture (single/multi-site, indexer clustering, search head clustering, ). Define data ingestion strategies and architecture best Install, configure, and optimize Splunk components (forwarders, indexers, heavy forwarders, search heads, deployment servers). Set up and manage Splunk deployment servers, apps, and configuration bundles. Log Source Onboarding Identify, prioritize, and onboard critical log sources across IT, cloud, network, security, and application Develop onboarding playbooks for common and custom log Create parsing, indexing, and field extraction logic using conf, transforms.conf, and custom apps. Ensure log data is normalized and categorized according to CIM (Common Information Model). Use Case Development s Configuration Work with SOC teams to define security monitoring requirements and detection Configure security use cases, correlation rules, and alerting within Splunk Enterprise Security (ES) or core Develop dashboards, alerts, and scheduled reports to support threat detection, compliance, and operational Tune and optimize correlation rules to reduce false Tool Integration Integrate Splunk with third-party tools and platforms such as: Ticketing systems (ServiceNow, JIRA) Threat Intelligence Platforms (Anomali) SOAR platforms (Splunk SOAR, Palo Alto XSOAR) Endpoint C Network tools (CrowdStrike, Fortinet, Cisco, ) Develop and manage APIs, scripted inputs, and custom connectors for data ingestion and bidirectional Documentation s Handover Maintain comprehensive documentation for architecture, configurations, onboarding steps, and operational Conduct knowledge transfer and operational training for security Create runbooks, SOPs, and configuration backups for business Prepare HLD and LLD documents for Solution Required Skills s Experience 5+ years of experience in SIEM implementation, with at least 3 years focused on Strong knowledge of Splunk architecture, deployment methods, data onboarding, and advanced search. Experience in building Splunk dashboards, alerts, and use case logic using SPL (Search Processing Language). Familiarity with Common Information Model (CIM) and data normalization Experience integrating Splunk with external tools and writing automation scripts (Python, Bash, ). Preferred Certifications Splunk Core Certified Power User Splunk Certified Admin or Architect Splunk Enterprise Security Certified Admin (preferred) Security certifications like CompTIA Security+, GCIA, or CISSP (optional but beneficial) Why Gruve At Gruve, we foster a culture of innovation, collaboration, and continuous learning. We are committed to building a diverse and inclusive workplace where everyone can thrive and contribute their best work. If you’re passionate about technology and eager to make an impact, we’d love to hear from you. Gruve is an equal opportunity employer. We welcome applicants from all backgrounds and thank all who apply; however, only those selected for an interview will be contacted. Show more Show less
