We are seeking a skilled Splunk Secuirty Administrator to join our team and take charge of implementing, configuring, managing, and maintaining Splunk Cloud, Splunk Enterprise Security, and related logging-based security platforms.
In this role, you will:
- Leverage your expertise in managing large-scale Splunk Enterprise or Splunk Cloud environments.
- Focus on ensuring information security and implementing secure systems.
- Review, assess, recommend, and deploy technical controls to maintain a well-managed and resilient Splunk environment.
- Conduct routine maintenance and configuration management to uphold system reliability and performance.
- Collaborate with the Splunk Team Lead and provide support as needed.
In this role, you'll work in one of our IBM Consulting Client Innovation Centers (Delivery Centers), where we deliver deep technical and industry expertise to a wide range of public and private sector clients around the world. Our delivery centers offer our clients locally based skills and technical expertise to drive innovation and adoption of new technology.
What You'll Do as a Splunk Administrator:
- Manage and Maintain Complex Deployments: Oversee the management, upkeep, and design/expansion of a sophisticated Splunk deployment.
- Event Collection Administration: Administer all aspects of Splunk event collection and forwarding processes.
- Splunk Cloud & Enterprise Security Administration: Configure and manage Splunk Cloud and Enterprise Security, including indexes, source types, field mappings, CIM compliance, and maintaining ES use cases and SPL queries.
- Data Configuration: Configure and manage props and transforms for both standard and proprietary data types.
- Use Case Implementation: Develop and implement security and business use cases within the Splunk framework.
- Syslog Management: Manage syslog configurations and forwarding using tools like syslog-ng or SC4S.
- Dashboard & Report Creation: Create custom dashboards, reports, and alerts tailored to organizational needs.
- Complex Query Development: Design and troubleshoot complex Splunk queries in SPL and XML for reports and dashboards, ensuring optimized performance for large data sets.
- Log Data Flow Management: Understand and implement log data flows between source systems and Splunk components.
- Custom Applications: Write applications, preferably in Python, to pull data from source systems for integration into Splunk.
- Custom Field Extractions: Develop custom field extractions, technology add-ons (TAs), and source types to enhance data processing.
Qualifications & Requirements for the Splunk Administrator Role:
Experience:
- 5+ years of direct administration experience with Splunk Cloud, Splunk Enterprise, or Splunk Enterprise Security environments.
- 3+ years designing, engineering, and securing complex infrastructure architectures.
- 1+ years working within a cybersecurity organization or Security Operations team.
Cloud Expertise:
- Proven experience in ingesting data from cloud environments using tools like Lambda functions, Kinesis Firehose, or other push methodologies.
- Hands-on experience with cloud platforms such as AWS, Azure, or Google Cloud Platform (GCP).
- Skilled in event collection and logging best practices within cloud infrastructure and services.
Technical Skills:
- Strong background in Windows and Linux administration.
- Scripting experience with Bash, Python, or Ruby.
- Familiarity with containerized and serverless computing platforms.
Security Expertise:
- Knowledge of secrets management, encryption technologies, and key management.
- Experience in log management across various infrastructure and platform service tiers.
Certifications & Compliance:
- Splunk Certified Administrator or Architect certification.
- Familiarity with regulatory compliance requirements.