Splunk SIEM Specialist

Position Overview

We are seeking an experienced Splunk SIEM Specialist to lead and support end-to-end SIEM solution activities, including migrations, implementations, onboarding, normalization, content development, troubleshooting, platform management, and optimization. The ideal candidate will have deep expertise in Splunk administration and a strong background in security operations, log management, and use case development.

Key Responsibilities

• SIEM Migration & Implementation

• Lead and execute SIEM solution migrations, including planning, data transfer, and validation.
• Implement and configure Splunk SIEM solutions tailored to organizational security requirements.

• Log Onboarding & Normalization

• Onboard diverse log sources into Splunk, ensuring data is parsed and normalized according to the Common Information Model (CIM).
• Develop and maintain data models, field extractions, and event parsing logic.

• Content Development & Tuning

• Design, develop, and tune detection rules, correlation searches, dashboards, and alerts.
• Continuously optimize content to reduce false positives and improve detection accuracy.

• Troubleshooting & Platform Management

• Diagnose and resolve issues related to log ingestion, parsing, and platform performance.
• Monitor and maintain the health, availability, and scalability of the Splunk environment.

• SIEM Optimization & Administration

• Perform regular platform optimization, including indexing, storage management, and search performance tuning.
• Administer Splunk components (indexers, search heads, forwarders, etc.) and manage upgrades/patches.

• Deployment & Solution Delivery

• Deploy and configure Splunk SIEM solutions in both on-premises and cloud environments.
• Collaborate with stakeholders to ensure successful delivery of security monitoring capabilities.

• Gap Analysis & Use Case Development

• Conduct log source and use case gap analysis to identify coverage gaps and recommend enhancements.
• Work with security teams to develop new use cases aligned with evolving threat landscapes.

Required Skills & Qualifications

• 3+ years of hands-on experience with Splunk SIEM (Enterprise Security preferred).
• Strong understanding of SIEM concepts, log management, and security operations.
• Proficiency in log source onboarding, parsing, and CIM compliance.
• Experience in content development (correlation rules, dashboards, alerts) and tuning.
• Solid troubleshooting skills for both Splunk platform and security content.
• Experience with Splunk administration, deployment, and health monitoring.
• Familiarity with SIEM optimization techniques and best practices.
• Ability to conduct gap analysis and develop actionable recommendations.
• Excellent communication and documentation skills.
• Relevant certifications (e.g., Splunk Certified Admin, Splunk Enterprise Admin, Splunk Certified Architect) are a plus.

Preferred Experience

• Strong Knowledge in Security concepts
• Experience with cloud-based SIEM deployments (AWS, Azure, GCP).
• Knowledge of scripting languages (Python, Bash) for automation.

Exposure to other SIEM platforms (QRadar, Sentinel, SecOps, XSIAM, etc.) is advantageous.