This role is part of Cognizant's engagement with one of our most strategic global technology clients — a world leader in enterprise cybersecurity and behavioural analytics. You will work on sophisticated UBA environments, contributing to insider threat detection and security analytics at enterprise scale.

About The Role

We are seeking a Splunk UBA Engineer to investigate and resolve complex behavioural analytics and insider threat detection issues. This is a specialist role for a security-focused engineer with deep knowledge of anomaly detection, threat modelling, and user entity behaviour analytics.

What You Will Do

Investigate and resolve issues related to anomaly detection failures, threat model misconfigurations, missing or delayed risk events, and data ingestion inconsistencies
Analyse UBA logs, system diagnostics, data pipelines, and ingestion flows
Monitor and optimise user and entity behaviour models, threat detection algorithms, and risk scoring
Investigate suspicious activities and insider threats; validate and tune anomaly detection thresholds
Ensure accurate ingestion of authentication logs, network data, and endpoint data
Troubleshoot data mapping and normalisation issues
Optimise UBA performance through model fine-tuning, scoring mechanisms, and bottleneck resolution
Develop Python/Shell scripts to automate tasks and enhance data processing and alerting workflows
Collaborate with engineering teams to enhance detection coverage and improve UBA configurations
Create and maintain technical documentation, SOPs, runbooks, and troubleshooting playbooks

What You Bring

Strong understanding of security analytics, anomaly detection, threat modelling, and behavioural analytics
Splunk administration knowledge and log analysis skills
Linux fundamentals and basic networking knowledge (TCP/IP, DNS, HTTP/S)
Experience with cloud platforms (AWS/Azure/GCP) and scripting (Python/Shell)

Technical Skills Splunk UBA

Splunk Admin
Linux
AWS/Azure/GCP
Python
Shell
JIRA
Git

Splunk UBA Engineer (Tier II / Tier III)