Splunk Engineer / Administration

Role: Splunk Engineer/Administrator
Location: San Antonio, TX (Hybrid)
Duration: 12+ Month Contract

Qualifications:
 

• 8+ years of overall IT experience.
• 3+ years’ experience in managing, designing, and configuring Splunk environments (both on-prem and cloud).
• 3+ years’ experience in a Linux environment, including administration, scripting, or supporting applications.
• Experience with Splunk Enterprise Security Premium Application and Splunk Enterprise.
• Experience in requirement gathering and documentation.
• Experience in developing and supporting Splunk applications.
• Experience in automation with programming languages like Python, Java, .NET, and Ansible is a plus.
• Experience in technologies like Git, Jira, and automation testing.
• Familiarity with Phantom, cloud computing, web interfaces, databases, and big data technologies (like Hadoop, Kafka, etc.).
• Understanding of Continuous Delivery and Continuous Integration.
• Splunk admin certification is mandatory.
• Excellent communication and interpersonal skills.
• Splunk core admin experience is mandatory.
   

Responsibilities:
 

• Support, admin, maintain, and expand Splunk infrastructure to meet future architecture design and deployment requirements.
• Develop distributed Splunk applications, including requirement gathering and coordinating Splunk setup.
• Recommended Splunk implementation best practices and fixes.
• Design, implement, and optimize Splunk applications (to include Enterprise Security), queries, knowledge objects, and data models.
• Perform basic and advanced scripting tasks with Splunk to automate repeatable processes using Python.
• Deploy best practices for developing Splunk apps and create a conceptual architecture for a continuous improvement initiative.
• Provide an impact assessment for migration efforts.
• Support Performance Testing and User Acceptance Testing.
• Design and implement custom searches and reports.
• Build proof of concepts for Splunk enhancements.
• Tuning the information model, defining reusable templates.
• Define reusable view templates and retention & archival policies.
• Provide an impact assessment for migration efforts and coordinate migration activities.
   

Nice to Have:
 

• Experience in security information and event management (SIEM).
• Experience with RTIR.
• Certifications in Splunk, CISSP, or similar.