AIOps Engineer

Cb•Ft Belvoir, VA

About The Position

The AIOps Engineer will lead the AIOps platform initiative, acting as the primary technical liaison to existing Network Engineering, ServiceNow, and SolarWinds administration teams to establish unified telemetry pipelines. This role involves architecting closed-loop remediation workflows by deeply integrating Splunk ITSI alerts with ServiceNow Event Management and Incident Management modules. The engineer will architect and maintain Splunk AIOps solutions across unclassified and classified enclaves to provide real-time situational awareness, and normalize/correlate network performance and fault data with server and application logs for a holistic view of enterprise health. Additionally, the role requires deploying custom machine learning models via Splunk MLTK to identify anomalous behavior, potential cyber threats, and infrastructure degradations, while engineering secure data ingestion pipelines for telemetry data from cross-domain solutions and tactical edge devices. The engineer will utilize IT Service Intelligence (ITSI) to correlate multi-source events, reducing noise and prioritizing high-impact mission alerts, and collaborate with the Cyber Security Service Provider (CSSP) to integrate AIOps insights into defensive cyber operations (DCO). Compliance with DoW STIGs and IL5/IL6 protocols, along with developing and maintaining architectural documentation and compliance traceability, is essential. The role also requires staying current on AIOps and related capabilities relevant to DoD, federal, and intelligence mission systems.

Requirements

Active Top Secret / Sensitive Compartmented Information (TS/SCI) required at time of hire.
Active IAT Level II certification (e.g., Security+ CE, CySA+, GSEC, or SSCP) required.
United States Citizenship is required.
7+ years of experience with Splunk Enterprise, including architectural design, cluster management, and advanced Search Processing Language (SPL).
3+ years of experience implementing AIOps workflows, including integration with enterprise ITSM solutions (ServiceNow) for automated root cause analysis and remediation.
Proven track record of building, testing, and tuning supervised and unsupervised models within the Splunk MLTK.
Advanced scripting skills for developing custom search commands, API integrations, and automating remediation tasks (e.g., Python).
Experience leading technical working groups and directing the efforts of adjacent infrastructure and development teams.
Prior experience working within a DoW/DoD Operations Center (NOC/SOC) or supporting mission-critical systems and networks.
Must be able to present designs, plans, and analyses of alternatives to technical leadership boards for approvals.

Nice To Haves

Experience aggregating and correlating telemetry from diverse tools, specifically SolarWinds, ServiceNow, and VMware vCenter.
Splunk Enterprise Certified Architect or Splunk ITSI Certified Admin.
Experience with Cloud Native Computing Foundation (CNCF) observability tools in secure hybrid multi-cloud environments (Azure/AWS).
Understanding of the Risk Management Framework (RMF) and the Authorization to Operate (ATO) process for AI/ML workloads.

Responsibilities

Lead the AIOps platform initiative by acting as the primary technical liaison to existing Network Engineering, ServiceNow, and SolarWinds administration teams to establish unified telemetry pipelines.
Architect closed-loop remediation workflows by deeply integrating Splunk ITSI alerts with ServiceNow Event Management and Incident Management modules.
Architect and maintain Splunk AIOps solutions across unclassified and classified enclaves to provide real-time situational awareness.
Normalize and correlate network performance and fault data from SolarWinds with server and application logs to provide a holistic view of enterprise health.
Deploy custom machine learning models via Splunk MLTK to identify anomalous behavior, potential cyber threats, and infrastructure degradations.
Engineer secure data ingestion pipelines for telemetry data from cross-domain solutions and tactical edge devices.
Utilize IT Service Intelligence (ITSI) to correlate multi-source events, reducing noise and prioritizing high-impact mission alerts.
Collaborate with the Cyber Security Service Provider (CSSP) to integrate AIOps insights into defensive cyber operations (DCO).
Ensure all observability tools comply with DoW STIGs and IL5/IL6 protocols; develop and maintain architectural documentation and compliance traceability.
Stay current on AIOps and related capabilities relevant to DoD, federal, and intelligence mission systems.