Splunk Architect

Splunk Architect

Job Summary

We are seeking an experienced Splunk Architect to design implement and lead enterprise-scale Splunk solutions for security monitoring observability log management and analytics. The ideal candidate will have strong expertise in Splunk architecture data onboarding search optimization dashboards integrations and large-scale deployments.

Key Responsibilities:

• Design and architect highly scalable secure and resilient Splunk Enterprise / Splunk Cloud environments.
• Define Splunk architecture deployment models data flows indexing strategies and retention policies.
• Lead implementation and migration of enterprise Splunk platforms.
• Develop and optimize SPL queries dashboards reports alerts and data models.
• Integrate Splunk with enterprise applications cloud platforms databases APIs and security tools.
• Design solutions for SIEM security monitoring IT operations application monitoring and observability.
• Implement and manage data ingestion from servers applications network devices cloud services and security platforms.
• Optimize indexing search performance storage licensing and platform capacity.
• Establish Splunk security RBAC governance and operational best practices.
• Provide technical leadership architecture documentation and design recommendations.
• Troubleshoot complex Splunk performance ingestion and search-related issues.
• Collaborate with security infrastructure application cloud and DevOps teams.

Required Skills:

• 10 years of experience in IT with strong hands-on Splunk experience.
• Strong experience designing enterprise Splunk architecture and deployment models.
• Expertise in Splunk Enterprise Splunk Cloud Splunk Enterprise Security (ES).
• Strong proficiency in SPL dashboards reports alerts and data models.
• Experience with Splunk Indexers Search Heads Heavy Forwarders Universal Forwarders and Cluster Management.
• Experience with data onboarding parsing field extraction CIM and source types.
• Strong knowledge of Linux/Unix environments.
• Experience with Python REST APIs and automation.
• Experience integrating Splunk with SIEM cybersecurity cloud and monitoring platforms.
• Knowledge of AWS/Azure/GCP and cloud-native architectures.
• Strong understanding of networking security authentication and enterprise infrastructure.
• Preferred Qualifications
• Splunk certifications such as Splunk Enterprise Certified Architect Splunk Enterprise Security Certified Admin or Splunk Core Certified Power User.
• Experience with SOAR ITSI Observability or OpenTelemetry.
• Experience with Kubernetes containers and microservices.
• Experience with DevOps CI/CD Terraform or Ansible.
• Strong communication stakeholder-management and technical leadership skills.