Splunk SIEM Specialist Coretek Labs India

3.0 - 8.0 years

0 - 1 Lacs

hyderabad

Hybrid

Job Description: Splunk SIEM Specialist Position Overview We are seeking an experienced Splunk SIEM Specialist to lead and support end-to-end SIEM solution activities, including migrations, implementations, onboarding, normalization, content development, troubleshooting, platform management, and optimization. The ideal candidate will have deep expertise in Splunk administration and a strong background in security operations, log management, and use case development. Key Responsibilities SIEM Migration & Implementation Lead and execute SIEM solution migrations, including planning, data transfer, and validation. Implement and configure Splunk SIEM solutions tailored to organizational security requirements. Log Onboarding & Normalization Onboard diverse log sources into Splunk, ensuring data is parsed and normalized according to the Common Information Model (CIM). Develop and maintain data models, field extractions, and event parsing logic. Content Development & Tuning Design, develop, and tune detection rules, correlation searches, dashboards, and alerts. Continuously optimize content to reduce false positives and improve detection accuracy. Troubleshooting & Platform Management Diagnose and resolve issues related to log ingestion, parsing, and platform performance. Monitor and maintain the health, availability, and scalability of the Splunk environment. SIEM Optimization & Administration Perform regular platform optimization, including indexing, storage management, and search performance tuning. Administer Splunk components (indexers, search heads, forwarders, etc.) and manage upgrades/patches. Deployment & Solution Delivery Deploy and configure Splunk SIEM solutions in both on-premises and cloud environments. Collaborate with stakeholders to ensure successful delivery of security monitoring capabilities. Gap Analysis & Use Case Development Conduct log source and use case gap analysis to identify coverage gaps and recommend enhancements. Work with security teams to develop new use cases aligned with evolving threat landscapes. Required Skills & Qualifications 3+ years of hands-on experience with Splunk SIEM (Enterprise Security preferred). Strong understanding of SIEM concepts, log management, and security operations. Proficiency in log source onboarding, parsing, and CIM compliance. Experience in content development (correlation rules, dashboards, alerts) and tuning. Solid troubleshooting skills for both Splunk platform and security content. Experience with Splunk administration, deployment, and health monitoring. Familiarity with SIEM optimization techniques and best practices. Ability to conduct gap analysis and develop actionable recommendations. Excellent communication and documentation skills. Relevant certifications (e.g., Splunk Certified Admin, Splunk Enterprise Admin, Splunk Certified Architect) are a plus. Preferred Experience Strong Knowledge in Security concepts Experience with cloud-based SIEM deployments (AWS, Azure, GCP). Knowledge of scripting languages (Python, Bash) for automation. Exposure to other SIEM platforms (QRadar, Sentinel, SecOps, XSIAM, etc.) is advantageous.

Posted 3 days ago

Apply

Start Your Job Search Today

Browse through a variety of job opportunities tailored to your skills and preferences. Filter by location, experience, salary, and more to find your perfect fit.