Senior Splunk Data Engineer

Senior Splunk Data Engineer

This is a key engineering role where you will collaborate closely with security, DevOps, and SRE teams to ensure visibility, uptime, and operational intelligence across distributed systems.

Key Responsibilities

• Design, architect, and implement scalable Splunk deployments in cloud or hybrid environments.
• Build and manage log ingestion pipelines using Splunk Universal Forwarders, HEC, syslog, and third-party connectors.
• Create and optimize SPL queries, dashboards, scheduled reports, and alerting mechanisms to support infrastructure and application monitoring.
• Automate log onboarding, parsing, field extractions, and tagging using scripts (Python, Shell).
• Integrate Splunk with cloud platforms such as AWS (CloudTrail, CloudWatch), Azure Monitor, and GCP Logging.
• Perform system tuning, indexing strategy planning, and data lifecycle management (retention/archival).
• Collaborate with developers and infrastructure engineers to onboard new services and improve observability coverage.
• Ensure security and compliance alignment using frameworks such as MITRE ATT&CK, NIST, and GDPR.
• Participate in incident response, root cause analysis, and continuous service improvement.

Candidate Profile

• Education:

  Bachelors / Masters in Computer Science, IT, or a related field.

• Experience:

  7 to 10 years total, with

  5+ years of hands-on Splunk experience

  in enterprise environments.

• Splunk Expertise:

  Strong understanding of Splunk architecture, SPL, knowledge objects, dashboards, ITSI, and Enterprise Security (ES).

• Scripting:

  Good knowledge of Python and Shell scripting for automation and integrations.

• Cloud Exposure:

  Working experience with AWS, Azure, or GCP log ingestion and cloud monitoring services.

• DevOps/Automation Tools:

  Familiar with CI/CD pipelines, Docker/Kubernetes, Ansible or Terraform is a plus.

• Soft Skills:

  Strong analytical, troubleshooting, and communication skills. Ability to lead conversations with technical and non-technical stakeholders.

Required Skills

• Splunk Enterprise / Cloud
• SPL (Search Processing Language)
• Data Onboarding and Field Extraction
• Python / Shell scripting
• AWS / Azure / GCP integration
• Infrastructure Monitoring
• SIEM & Security Analytics
• Log Forwarding (UF, HEC, Syslog)
• Dashboard & Alert Development
• ITSI (preferred)
• Performance Tuning & Capacity Planning

Certifications (Preferred but not mandatory)

• Splunk Certified Power User / Admin / Architect
• AWS / Azure Fundamentals or Architect Certification