Security Platform Engineer

Accountabilities

• Design, implement, administer, and maintain Splunk Enterprise and Splunk Enterprise Security environments at enterprise scale.
• Deploy, configure, and manage Cribl Stream for log routing, filtering, masking, enrichment, and optimization.
• Develop and maintain data onboarding pipelines from security, infrastructure, cloud, and enterprise technology sources.
• Configure and troubleshoot log ingestion, parsing, field extraction, normalization, Common Information Model (CIM) mapping, and data models.
• Optimize Splunk searches, dashboards, reports, correlation searches, and other monitoring content for performance and scalability.
• Build and maintain detection use cases, alerts, and security monitoring capabilities.
• Develop security automation workflows using platforms such as Tines, Splunk SOAR, Cortex XSOAR, or similar technologies.
• Integrate security and enterprise tools including Microsoft Defender, CrowdStrike, Palo Alto, Zscaler, Okta, AWS, Azure, and related technologies.
• Troubleshoot ingestion failures, parsing issues, search performance problems, and distributed platform architecture challenges.
• Implement platform monitoring, health checks, capacity planning, upgrades, and operational best practices.
• Collaborate with SOC analysts, security engineers, architects, and infrastructure teams to support security operations.
• Create and maintain technical documentation, standard operating procedures, and operational runbooks.

Requirements

• 5+ years of hands-on experience working with Splunk Enterprise, with strong expertise in enterprise administration and support.
• Strong experience with Splunk Enterprise Security and security monitoring environments.
• Hands-on experience administering Cribl Stream and developing data processing pipelines.
• Strong understanding of log onboarding, parsing, field extraction, normalization, CIM, and data modeling.
• Proficiency with Splunk Search Processing Language (SPL).
• Experience working with Splunk index management, forwarders, deployment servers, search heads, indexers, and clustered environments.
• Experience integrating cloud platforms and security products with Splunk.
• Knowledge of Linux administration and troubleshooting.
• Experience working with REST APIs and JSON.
• Scripting experience using Python, PowerShell, Bash, or similar technologies.
• Strong troubleshooting, analytical, and problem-solving skills.
• Experience with security automation platforms such as Tines, Splunk SOAR, Cortex XSOAR, Swimlane, or Torq is preferred.
• Familiarity with Microsoft Sentinel, Microsoft Defender XDR, CrowdStrike Falcon, Palo Alto, AWS, Azure, or GCP is advantageous.
• Knowledge of the MITRE ATT&CK framework and familiarity with security operations and incident response workflows.
• Experience with Git, CI/CD, and Infrastructure as Code is a plus.
• Relevant certifications such as Splunk Core Certified Power User, Splunk Enterprise Certified Admin, Splunk Enterprise Security Certified Admin, Cribl certifications, CISSP, or GIAC certifications are advantageous.
• Experience designing enterprise SIEM architectures, developing threat detection capabilities, or implementing SOC automation is highly valued.
• Strong communication and collaboration skills with the ability to work effectively across technical and security teams.

Benefits

• Competitive compensation of $46–$60 per hour, with the starting rate dependent on qualifications, experience, and location.
• W2 employment structure.
• Option to elect healthcare benefits, including medical, dental, and vision insurance.
• Major holiday benefits.
• Paid sick leave in accordance with applicable state law.
• Opportunity to work with enterprise-scale security platforms and modern SIEM technologies.
• Exposure to security automation, cloud security, threat detection, and SOC operations.
• Opportunity to develop expertise across Splunk, Cribl, SOAR platforms, and leading security technologies.
• Remote work opportunity.