Cyber & IT Operations Analytics Engineer

KDA Consulting • Herndon, VA

23h

About The Position

We are seeking a hands-on Cyber & IT Operations Data / Splunk Analytics Engineer to support the Sponsor’s IT systems data modernization ecosystem. The role addresses data challenges by establishing data quality baselines, schema standards, and normalization pipelines for high-velocity, disparate cyber feeds and IT operations telemetry, including system performance metrics, service health, network infrastructure logs, and application events.

Working within an Agile engineering environment, the engineer will architect ingest pipelines, build optimized Splunk models and correlation searches, and transform raw telemetry into standardized, high-confidence data for threat analysis and IT operational health monitoring. The role also supports operational dashboards and reporting, and integration of standardized cyber and IT datasets with downstream machine learning and automated analytics tooling.

Requirements

• Hands-on experience deploying, architecting, managing, and optimizing distributed enterprise Splunk environments, including index management, forwarder configurations, search optimization, and data model acceleration.
• Proven experience with log and metric telemetry, including syslog, Windows Event Logs, network flows, application logs, and infrastructure metrics.
• Experience with field extraction using props.conf and transforms.conf, and enforcing data quality and normalization standards across high-throughput data streams.
• Experience ingesting, parsing, and routing streaming data using Splunk native inputs, HTTP Event Collector (HEC), Apache NiFi, or Kafka.
• Ability to write scripts in Python or Bash, or use JSON/REST APIs, to automate data collection, pipeline health monitoring, and data sanitization tasks.
• Solid working knowledge of Linux system administration, network connectivity troubleshooting, and secure cloud environments such as AWS.
• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field, or equivalent operational engineering experience.
• Must have an active TS/SCI with Polygraph Clearance.

Responsibilities

• Standardize, cleanse, and normalize high-velocity machine data from security tools and IT operational systems into common information schemas such as Splunk CIM.
• Configure, tune, monitor, and administer distributed Splunk infrastructure and ingest streams, including Heavy Forwarders, Universal Forwarders, Indexer Clusters, and Search Head Clusters.
• Develop complex, performance-optimized SPL queries, accelerated data models, event correlations, and real-time alerts for cyber threat detection and IT operational reliability and availability.
• Design and support data routing, parsing, filtering, and transformation pipelines for logs, metrics, and traces using Splunk Forwarders, Syslog/HEC, or Apache NiFi.
• Build operational dashboards and reporting interfaces that make security events and IT operational health and performance indicators actionable for engineers and leadership.
• Collaborate with platform and cloud engineers to integrate standardized cyber and IT operational datasets with downstream machine learning and automated analytics tooling.

What This Job Offers

• Job Type: Full-time