Splunk Engineer
- Posted 2 months ago
- Be among the first 40 applicants
Job Description
Job Title: Splunk Engineer
Location: Chennai
Experience: 4–8 Years
Employment Type: Full-Time
Notice Period: Immediate Joiners or Up to 15 Days
About The Role
We are looking for a highly skilled Splunk Engineer to design, implement, administer, and optimize enterprise Splunk environments. The ideal candidate will have hands-on experience with Splunk Enterprise, Splunk Enterprise Security (ES), log management, SIEM, security monitoring, and automation. The role involves building scalable logging solutions, developing detection use cases, and supporting Security Operations Center (SOC) initiatives.
Key Responsibilities
Mandatory Skills
Location: Chennai
Experience: 4–8 Years
Employment Type: Full-Time
Notice Period: Immediate Joiners or Up to 15 Days
About The Role
We are looking for a highly skilled Splunk Engineer to design, implement, administer, and optimize enterprise Splunk environments. The ideal candidate will have hands-on experience with Splunk Enterprise, Splunk Enterprise Security (ES), log management, SIEM, security monitoring, and automation. The role involves building scalable logging solutions, developing detection use cases, and supporting Security Operations Center (SOC) initiatives.
Key Responsibilities
- Design, deploy, configure, and administer Splunk Enterprise and Splunk Enterprise Security (ES).
- Install and maintain Splunk components, including Indexers, Search Heads, Forwarders, Deployment Servers, and Cluster Managers.
- Develop and optimize Splunk dashboards, reports, alerts, and visualizations.
- Create and maintain SPL (Search Processing Language) queries, correlation searches, and detection rules.
- Integrate log sources from Windows, Linux, cloud platforms, firewalls, databases, applications, and network devices.
- Configure and manage data ingestion, parsing, indexing, retention, and storage optimization.
- Monitor the health, performance, and scalability of Splunk infrastructure.
- Support security monitoring, threat detection, incident investigation, and forensic analysis.
- Integrate Splunk with SOAR platforms, threat intelligence feeds, and third-party security tools.
- Collaborate with SOC analysts, security engineers, and infrastructure teams to enhance detection capabilities.
- Troubleshoot ingestion issues, performance bottlenecks, and platform-related problems.
- Perform upgrades, patching, backup, disaster recovery, and capacity planning.
- Create technical documentation, operational runbooks, and knowledge base articles.
Mandatory Skills
- Splunk Enterprise
- Splunk Enterprise Security (ES)
- Splunk Search Processing Language (SPL)
- SIEM Administration
- Log Management
- Security Monitoring
- Correlation Searches
- Dashboards & Reporting
- Universal Forwarders
- Heavy Forwarders
- Indexers & Search Heads
- Deployment Server
- Cluster Management
- Windows Server Administration
- Linux Administration
- Syslog
- REST APIs
- PowerShell
- Python
- TCP/IP Networking
- Splunk SOAR (Phantom)
- Splunk ITSI
- Splunk UBA (User Behavior Analytics)
- Microsoft Sentinel
- Microsoft Defender XDR
- CrowdStrike Falcon
- Palo Alto Networks
- QRadar
- ArcSight
- Elastic Stack (ELK)
- AWS CloudWatch
- Azure Monitor
- Kubernetes
- Docker
- ServiceNow Integration
- MITRE ATT&CK Framework
- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related field.
- 4–8 years of experience in Splunk Administration, SIEM Engineering, or Security Operations.
- Strong hands-on experience with Splunk Enterprise and Splunk Enterprise Security (ES).
- Experience onboarding diverse log sources and developing correlation rules.
- Strong understanding of SIEM architecture, security monitoring, and incident response.
- Knowledge of Windows, Linux, networking, cloud platforms, and cybersecurity fundamentals.
- Experience with scripting (PowerShell or Python) for automation.
- Excellent analytical, troubleshooting, and problem-solving skills.
- Strong communication and documentation skills.
- Splunk Core Certified Power User
- Splunk Enterprise Certified Admin
- Splunk Enterprise Certified Architect
- Splunk Certified Cybersecurity Defense Analyst
- Microsoft Certified: Security Operations Analyst Associate (SC-200)
- Microsoft Certified: Azure Security Engineer Associate (AZ-500)
- CompTIA CySA+
- Certified Information Systems Security Professional (CISSP) (Preferred)
- GIAC Certified Incident Handler (GCIH) (Preferred)
- Strong analytical and troubleshooting capabilities.
- Excellent communication and presentation skills.
- Ability to work independently and collaboratively in a team environment.
- Strong documentation and reporting skills.
- Ability to manage multiple priorities in a fast-paced environment.
- Passion for cybersecurity and continuous learning.
More Info
Key Skills
Heavy Forwarders
Correlation Searches
Deployment Server
Dashboards Reporting
SIEM Administration
Indexers Search Heads
Splunk Search Processing Language SPL
Splunk Enterprise
Splunk Enterprise Security ES
TCP IP Networking
Universal Forwarders
About Company