Splunk & Cribl Platform Engineer IV

Job Title: Splunk & Cribl Platform Engineer IV
Work Arrangement: Hybrid (4 days onsite / 1 day remote for the first 6 months then 3 days onsite / 2 days remote after)
Location: Richmond VA / Charlotte NC / Pennington NJ (local candidates only)
Employment Type: Contract 12 Months
Engagement Type: W2 only; must be authorized to work in the US without employer sponsorship now or in the future
Final Interview: 2 virtual rounds; onsite interview may also be requested

Dhaka Technologies Limited Company (DTLC) is hiring a Splunk & Cribl Platform Engineer IV on behalf of its client i8is for end client Bank of America.

The client is hiring a senior Splunk and Cribl platform engineer to support a large-scale highly distributed Splunk Enterprise and Splunk Cloud environment that directly feeds the banks Information Security and SOC teams. This is a production ownership role not a monitoring or dashboard-building role.

Splunk Platform Operations and Production Stability

• Own end-to-end production support for search head clusters indexer clusters deployers deployment servers and forwarders
• Ensure high availability performance and resiliency for security and operational use cases
• Lead incident response troubleshooting root cause analysis and service restoration for Splunk and Cribl
• Proactively identify risks capacity constraints and performance bottlenecks implement preventive and tuning measures

Security Log Ingestion and SIEM Enablement

• Serve as a key technical enabler for Information Security and SOC teams
• Onboard and normalize new data sources supporting CIM compliance and field normalization
• Tune ingestion pipelines using and
• Build and support dashboards searches and alerts for threat detection and investigations

Cribl Data Pipeline Management

• Administer and support Cribl for data routing filtering enrichment and cost optimization
• Ensure data integrity reliability and performance across ingestion pipelines
• Collaborate with architecture teams on data flow strategies and onboarding standards

Governance Documentation Compliance

• Develop and maintain runbooks SOPs installation guides and operational documentation
• Adhere to change management incident management and SLA commitments

• 5 years hands-on administering large-scale Splunk Enterprise or Splunk Cloud
• Real platform admin experience not dashboard or alert building for other applications fastest screen-out
• Indexer clustering and search head clustering
• Universal and heavy forwarder architectures
• SmartStore / S3-compatible object storage
• SPL search optimization summary indexing data model acceleration
• Deep experience with security log ingestion and SIEM use cases
• Proven ability to lead production incidents perform RCA drive preventive solutions
• Strong Linux administration
• Cribl administration (data routing filtering enrichment) required not a nice-to-have
• Excellent written and verbal communication able to engage senior stakeholders

• Splunk certifications (Enterprise Admin or Enterprise Architect)
• Splunk ES and SOAR experience (Phantom or equivalent general exposure fine)
• Cloud logging/security architecture exposure (AWS Azure GCP)
• RHEL and Windows Server administration
• Monitoring APM event management tool experience
• Strong understanding of security network system and database operations
• Ability to balance multiple priorities in a fast-paced environment

• Manage cluster-level issues end to end
• Deep-dive data flow and ingestion issues
• Onboard and normalize new data sources for InfoSec/SOC use
• Operate calmly during high-severity incidents
• Own runbooks SOPs audit-ready documentation

Interested candidates or anyone referring a qualified professional may send an updated resume to with the subject line "Splunk & Cribl Platform Engineer IV".

Required Skills:

5 years hands-on Splunk Enterprise or Splunk Cloud administration; indexer and search head clustering; universal and heavy forwarders; SmartStore / S3-compatible object storage; SPL search optimization summary indexing data model acceleration; security log ingestion and SIEM use cases; production incident leadership and RCA; strong Linux administration; Cribl administration (data routing filtering enrichment) required