Splunk Enterprise Security Expert

Accountabilities

• Provide centralized governance and lifecycle management for Splunk knowledge objects, including saved searches, correlation searches, field extractions, tags, aliases, event types, lookups, macros, data models, workflow actions, and KV Store collections.
• Establish and enforce enterprise-wide naming conventions, taxonomy standards, ownership models, permissions, and lifecycle processes for Splunk content.
• Audit knowledge object libraries to identify duplicate, orphaned, deprecated, or conflicting content and drive consolidation or retirement where appropriate.
• Develop automation to monitor data ingestion, data flow consistency, normalization drift, and other critical aspects of the Splunk environment.
• Maintain an enterprise knowledge object registry documenting ownership, scope, purpose, permissions, and lifecycle stage.
• Collaborate with platform teams to define appropriate permission structures and sharing models across applications, environments, and user groups.
• Lead the promotion of knowledge objects through development, testing, staging, and production using change control, CI/CD, and GitOps practices.
• Serve as the enterprise authority for Splunk Common Information Model (CIM) normalization and maintain compliant field mappings across endpoint, network, identity, cloud, and application data sources.
• Design, build, and maintain Splunk data models supporting Pivot users, Enterprise Security correlation searches, reporting, and risk-based analytics.
• Manage data model acceleration strategies, including TSIDX, tstats, and summary indexing, while monitoring search load, acceleration performance, and coverage.
• Define and enforce source-type and index taxonomy standards to improve search performance, configuration consistency, and usability across teams.
• Ensure asset zones, network zones, identity tiers, and other entity enrichment are incorporated into data models and Enterprise Security frameworks.
• Maintain CIM coverage matrices connecting data model fields with MITRE ATT&CK techniques, detection use cases, and compliance controls.
• Own the enterprise Splunk knowledge architecture, including taxonomy hierarchies, content standards, metadata schemas, and classification frameworks.
• Develop and maintain knowledge management standards covering naming conventions, lifecycle stages, ownership, permissions, CIM mappings, and change control procedures.
• Lead a cross-functional knowledge governance working group involving detection engineering, SOC operations, platform engineering, compliance, and application teams.
• Create reusable templates for correlation searches, dashboards, reports, lookups, and macros to accelerate development while maintaining governance standards.
• Design and implement automation using Python, Bash, GitHub Actions, and related tooling to improve knowledge object management and deployment.
• Maintain clear technical documentation, including architecture documentation, standards guides, runbooks, and operational procedures.
• Support detection engineering, threat hunting, and SOC teams by ensuring Splunk content is reliable, discoverable, performant, and aligned with operational needs.

Requirements

• Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, or a related field, or equivalent professional experience.
• 8+ years of hands-on Splunk experience in enterprise environments.
• At least 3 years of direct experience in Splunk knowledge management, CIM normalization, SIEM content engineering, or comparable large-scale Splunk environments.
• Experience working with large-scale Splunk deployments, ideally handling 20+ TB of data per day.
• Deep expertise in Splunk Enterprise Security, including correlation searches, notable events, risk-based alerting, ES data models, threat intelligence, and asset and identity frameworks.
• Advanced proficiency in SPL, including complex statistical pipelines, tstats, macros, sub-searches, evaluation functions, and streaming and non-streaming commands.
• Strong understanding of Splunk data models, acceleration strategies, Pivot functionality, and Enterprise Security dependencies.
• Comprehensive knowledge of Splunk knowledge objects and their full lifecycle, including field extractions, lookups, KV Store collections, macros, tags, aliases, event types, workflow actions, saved searches, and correlation searches.
• Deep administrative and engineering experience with distributed, multi-site, and clustered Splunk Enterprise environments.
• Experience developing or reviewing Splunk Technology Add-ons and applications, including packaging and deployment through Deployment Server and Deployer.
• Strong understanding of Splunk configuration management, including configuration files, btool, precedence rules, and the Splunk Admin Config Service.
• Experience with Splunk Edge Processor or Ingest Processor and awareness of pipeline-level routing and data transformation.
• Practical experience integrating telemetry from AWS, Azure, and GCP environments and normalizing cloud-native data sources.
• Strong Linux and Windows administration knowledge.
• Experience using Python and Bash/Shell scripting to automate Splunk administration, knowledge object management, and API-driven deployments.
• Experience with GitHub, GitHub Actions, CI/CD pipelines, and version-controlled content promotion workflows.
• Familiarity with MITRE ATT&CK, NIST CSF, NIST 800-53, CIS Benchmarks, and security or compliance-driven detection requirements.
• Background in detection engineering, threat hunting, SOC operations, or another security discipline that provides an understanding of how Splunk content supports analysts.
• Demonstrated ability to create and maintain technical documentation, standards, architecture guides, and operational runbooks.
• Strong analytical, problem-solving, communication, and collaboration skills, with the ability to work across multiple technical and security teams.
• Splunk certifications such as Splunk Core Certified Consultant, Splunk Enterprise Security Certified Admin, or Splunk Certified Architect are strongly preferred.
• Security certifications such as GIAC credentials are a plus.
• Experience with Splunk SOAR, Splunk UBA, infrastructure-as-code tools such as Ansible or Terraform, and AI-assisted automation is desirable.
• Familiarity with Kafka, streaming data pipelines, real-time telemetry routing, and very large-scale Splunk environments is advantageous.

Benefits

• Competitive contract compensation of approximately $60 per hour, with the final rate depending on qualifications, experience, and location.
• Contract opportunity with an expected duration of 6+ months.
• Remote work arrangement.
• Competitive compensation package for eligible W2 employees.
• Healthcare options, including medical, dental, and vision coverage.
• Paid sick leave in accordance with applicable state requirements.
• Major paid holidays.
• Opportunity to work on complex enterprise cybersecurity and SIEM environments.
• Exposure to large-scale Splunk Enterprise Security, cloud telemetry, automation, and security operations technologies.
• Opportunity to contribute to enterprise-wide architecture, governance, and security engineering initiatives.