Data Intake & Integrations (D&I) Analyst- Mid (Splunk)

Pueo Business Solutions LLC • McLean, VA

5d • $102,000 - $142,425 • Onsite

About The Position

Pueo is seeking a mid-level Data Intake & Integrations (D&I) Analyst to provide operational and engineering support for the Department of the Treasury’s enterprise Splunk environment under the Treasury Enterprise SIEM (TESIEMS) program. The role is onsite in McLean, Virginia, and supports the onboarding, normalization, and quality of data used by Treasury SOC teams for cybersecurity detection, response, and compliance reporting.

The D&I team manages log and data sources entering TESIEMS, measures format deviations, supports data segregation by Treasury component and FISMA boundary, and monitors data coverage and quality. It coordinates with federal stakeholders, bureau security teams, and vendors to onboard and standardize feeds; responds to disrupted pipelines; supports SOC consolidation and multitenancy; manages orchestration such as audit logging and ticketing automation; and integrates with asset management, compliance, and threat intelligence systems.

The analyst administers Splunk and supports its operation in hybrid environments, including on-premises infrastructure, AWS, and Linux virtual machines. The position onboards and validates data, tunes ingestion and search performance, maintains configuration and documentation, and ensures that data intake and retention support Treasury security and compliance requirements. The analyst also provides Tier II/III support and partners with SOC analysts, content engineers, compliance teams, and system stakeholders.

Requirements

• Seven years of relevant experience; 11 years total may substitute for the bachelor’s degree requirement.
• Bachelor’s degree in cybersecurity, computer science, information technology, or a related field, or the stated experience substitution.
• Required Splunk Core Certified User certification.
• Active Secret clearance; interim Secret clearance is not accepted.
• Must be a U.S. citizen.
• Knowledge of cybersecurity principles, practices, and related specialty areas.
• Knowledge of Splunk Enterprise architecture and the Splunk Common Information Model (CIM).
• Knowledge of hybrid infrastructure, including on-premises servers, AWS compute and storage, virtual machines, and Linux environments.
• Knowledge of incident detection, incident response, and security event management.
• Knowledge of NIST SP 800-53, NIST RMF, FISMA, FedRAMP, and DISA STIGs and their application in SOC environments.
• Skill administering Splunk Enterprise, including indexes, user management, and system performance.
• Skill onboarding data into Splunk using syslog, HEC, JSON, APIs, and other ingestion methods.
• Skill normalizing log data to CIM standards and tuning parsing, field extractions, and source types.
• Ability to script and automate in Python, Bash, or PowerShell for ingestion testing and log data analysis.
• Experience using security tools such as SIEMs, IDS/IPS, and endpoint detection tools.
• Strong technical documentation and communication skills.
• Ability to solve complex and unclear technical problems and independently develop and implement technical solutions.
• Ability to validate, troubleshoot, and normalize log data for operational and compliance use.
• Ability to assess the impact of changes on end products or solutions.
• Strong analytical and critical-thinking skills.
• Ability to collaborate with SOC teams, content engineers, cybersecurity experts, and system stakeholders.

Nice To Haves

• At least one higher-level Splunk certification: Splunk Enterprise Certified Architect, Splunk Enterprise Security Certified Admin, Splunk SOAR Certified Automation Developer, Splunk Cloud Certified Admin, or Splunk IT Service Intelligence (ITSI) Certified Admin.
• Relevant cybersecurity certification such as CISSP, CISM, or CompTIA CySA+.
• Prior SOC or Department of the Treasury experience.

Responsibilities

• Perform day-to-day Splunk administration, monitor system health, manage indexes, and troubleshoot ingestion and search performance issues.
• Support Splunk operations across on-premises servers, AWS compute and storage, and Linux virtual machines.
• Apply patches, upgrades, and configurations to maintain Splunk infrastructure stability and compliance.
• Onboard data sources using syslog, HTTP Event Collector (HEC), JSON feeds, APIs, and other ingestion methods.
• Normalize and validate ingested data to align with the Splunk Common Information Model (CIM) and SOC use cases.
• Collaborate with system owners, engineers, and SOC analysts to configure log forwarding and resolve onboarding issues.
• Develop and maintain ingestion pipelines for large-scale Treasury SOC operations.
• Tune parsing, field extractions, and source types for indexing and search performance.
• Document and maintain data onboarding procedures, schemas, and configuration standards.
• Ensure Splunk onboarding and data retention configurations align with Treasury security and compliance requirements, including NIST RMF and FISMA.
• Generate audit-ready intake documentation and data validation reports for compliance reviews.
• Work with compliance and CD&M teams to support continuous-monitoring and reporting mandates.
• Provide Tier II/III Splunk intake and administration support, escalating complex issues to senior Splunk engineers as needed.
• Partner with SOC analysts and content engineers so onboarded data supports detection, dashboards, and reporting.
• Contribute to DI&I process-improvement initiatives that streamline intake and optimize workflows.

Benefits

• Comprehensive medical plans.
• Professional development resources.
• Other rewards may include annual bonuses, short- and long-term incentives, and program-specific awards.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level