Sr. Security Engineer
Role Summary
The Splunk Platform Engineer is responsible for designing, onboarding, and optimizing log ingestion pipelines within the Splunk platform. This role focuses on data ingestion, parsing, normalization, and Common Information Model (CIM) compliance to ensure high‑quality, searchable, and scalable security and operational data. The engineer will work hands‑on with Universal Forwarders (UF), Heavy Forwarders (HF), and Cribl to improve data quality, performance, and cost efficiency across the Splunk ecosystem.
Key Responsibilities
Splunk Platform & Data Engineering
- Design, implement, and manage end‑to‑end log ingestion pipelines into Splunk.
- Onboard new data sources across infrastructure, security, cloud, and application platforms.
- Configure and manage Universal Forwarders (UF) and Heavy Forwarders (HF) for secure and scalable data collection.
- Perform data filtering, routing, masking, and enrichment using Heavy Forwarders and Cribl.
Parsing, Normalization & CIM
- Develop and maintain props.conf and transforms.conf for accurate parsing, timestamping, and field extractions.
- Normalize logs to Splunk Common Information Model (CIM) standards for consistent search, correlation, and reporting.
- Troubleshoot parsing, indexing, and data quality issues across multiple log sources.
Cribl & Optimization
- Implement and manage Cribl pipelines for data reduction, enrichment, routing, and cost optimization.
- Optimize ingestion volumes and indexing strategies to improve Splunk performance and licensing efficiency.
- Validate data integrity post‑processing and ensure downstream use case compatibility.
Platform Operations & Support
- Monitor Splunk ingestion health, forwarder performance, and data latency.
- Provide L2/L3 support for ingestion, parsing, and forwarder‑related issues.
- Maintain platform documentation, ingestion standards, and operational runbooks.
- Collaborate with SOC, Detection Engineering, and Security Engineering teams to support downstream analytics.
Required Skills & Experience
- 2–5 years of hands‑on experience with Splunk platform engineering or SIEM data onboarding.
- Strong experience with Splunk Universal Forwarders (UF) and Heavy Forwarders (HF).
- Proven expertise in log parsing, normalization, and CIM compliance.
- Hands‑on experience with Cribl for data routing, reduction, and enrichment.
- Strong knowledge of log formats (JSON, syslog, CSV, XML) and data pipelines.
- Proficiency in Splunk Search Processing Language (SPL) for validation and troubleshooting.
Preferred Qualifications
- Experience supporting security telemetry (EDR, IAM, network, cloud, application logs).
- Exposure to large‑scale Splunk environments in regulated enterprises.
- Scripting experience (Python, Bash, PowerShell) for automation and validation.
- Familiarity with Splunk indexer clustering, deployment server, and monitoring console.
