Cyber & IT Operations Analytics Engineer

KDA Consulting Inc•Herndon, VA

About The Position

The Cyber & IT Operations Analytics Engineer is a hands-on data and Splunk analytics engineer supporting the Sponsor’s IT systems data modernization ecosystem. The role addresses data challenges by establishing data quality baselines, schema standards, and normalization pipelines for high-velocity cyber feeds and IT operations telemetry, including system performance metrics, service health, network infrastructure logs, and application events. Working in an Agile engineering environment, the engineer architects and supports robust ingestion pipelines, builds optimized Splunk models and correlation searches, and transforms raw telemetry into standardized, high-confidence data for threat analysis and IT operational health monitoring. The position also develops dashboards and reporting interfaces, supports integrations with downstream machine learning and automated analytics tools, and administers distributed enterprise Splunk environments. An active TS/SCI with Polygraph clearance is required. A bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field is required, or equivalent operational engineering experience.

Requirements

Hands-on experience deploying, architecting, managing, and optimizing distributed enterprise Splunk environments.
Proven experience with log and metric telemetry, including syslog, Windows Event Logs, network flows, application logs, and infrastructure metrics.
Experience with field extraction using props.conf and transforms.conf.
Experience ingesting, parsing, and routing streaming data using Splunk native inputs, HTTP Event Collector (HEC), Apache NiFi, or Kafka.
Ability to write scripts in Python or Bash, or work with JSON/REST APIs, to automate data collection, pipeline health monitoring, and data sanitization.
Solid working knowledge of Linux system administration, network connectivity troubleshooting, and secure cloud environments such as AWS.
Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field, or equivalent operational engineering experience.
Active TS/SCI with Polygraph clearance.

Responsibilities

Establish data quality baselines, schema standards, and normalization pipelines for cyber feeds and IT operations telemetry.
Standardize, cleanse, and normalize machine data from security tools and IT operational systems into common information schemas such as Splunk CIM.
Configure, tune, monitor, and administer distributed Splunk infrastructure and ingestion streams, including Heavy Forwarders, Universal Forwarders, Indexer Clusters, and Search Head Clusters.
Develop complex, performance-optimized SPL queries, accelerated data models, event correlations, and real-time alerts for threat detection and IT operational reliability and availability.
Design and support data routing, parsing, filtering, and transformation pipelines for logs, metrics, and traces using Splunk Forwarders, Syslog/HEC, or Apache NiFi.
Build operational dashboards and reporting interfaces that present security events and IT operational health and performance indicators for engineers and leadership.
Collaborate with platform and cloud engineers to integrate standardized cyber and IT operational datasets with downstream machine learning and automated analytics tooling.
Manage and optimize distributed Splunk environments, including index management, forwarder configurations, search optimization, and data model acceleration.
Ingest, parse, and route streaming data using Splunk native inputs, HEC, Apache NiFi, or Kafka.
Write scripts and use APIs to automate data collection, pipeline health monitoring, and data sanitization tasks.
Apply data quality and normalization standards across high-throughput telemetry streams.