Senior Splunk Administrator

Leidos•Odenton, IL

About The Position

Leidos is seeking a highly skilled Senior Splunk Administrator to design, implement, and maintain its Splunk environment as part of the DISA Defense Red Switch Network, supporting an enterprise VoIP management system. The role requires deep knowledge of Splunk architecture and components, including forwarders, indexers, search heads, deployment servers, and web interfaces, as well as experience deploying Splunk on hardened Red Hat Enterprise Linux 8 (RHEL 8) systems. The administrator will integrate Splunk with RSA and configure it to work with RHEL 8 and Windows environments. The position includes responsibility for securing, monitoring, maintaining, and troubleshooting Splunk infrastructure; building reliable data ingestion and integration approaches; documenting the environment; and coordinating with security, network, and system administration teams. Candidates must hold a current DoD TS/SCI clearance, meet the stated education and experience criteria, and possess the required Splunk and DoD 8570 certifications. Candidates must be U.S. citizens.

Requirements

Current DoD TS/SCI security clearance.
Bachelor’s degree in Computer Science, Engineering, or a related field.
At least 12 years of experience in system administration, database administration, network engineering, software engineering, or software development, with a concentration in cybersecurity.
Eight years of experience with Linux and Windows system administration, or an advanced understanding of operating systems and common operating environments.
Five years of experience administering Splunk in distributed deployments.
Excellent written and verbal communication skills, including the ability to work with multiple customers, manage expectations, and track engagement scope.
Proficiency in data onboarding, including routing, parsing, and normalizing events to the Splunk CIM.
Proficiency onboarding data using Splunk add-ons for Windows, Linux, and common third-party devices and applications.
Experience onboarding data into Splunk through forwarders, scripted inputs, and modular inputs from a variety of sources.
Experience administering Splunk systems, including installation, configuration, performance and availability monitoring, upgrades, and troubleshooting.
General knowledge of networking and security troubleshooting, including firewalls, routing, and NAT.
Splunk implementation and troubleshooting experience.
Proficiency developing log ingestion and aggregation strategies in accordance with Splunk best practices.
Must hold a Splunk Certified Architect certification.
Must hold a DoD 8570 IAT Level II or Level III certification, such as Security+ CE.
Must be a U.S. citizen.

Nice To Haves

Experience configuring and maintaining the tool in a multi-tenant environment.
Experience troubleshooting RSA and Windows integration.
Experience troubleshooting RSA integration with Linux through PAM.
Experience troubleshooting Cisco ISE AAA.
Experience troubleshooting LDAPS.
Experience integrating applications with Radiant One through LDAPS.

Responsibilities

Design, implement, and maintain Splunk environments, including forwarders, indexers, search heads, and deployment servers.
Install, configure, and integrate Splunk and its components on RHEL 8 systems, ensuring performance, scalability, and security.
Harden the Splunk environment on RHEL 8 systems to meet security compliance standards and best practices.
Integrate Splunk with RSA for secure authentication and authorization across the environment.
Monitor Splunk infrastructure health, performance, and capacity, and perform routine maintenance to ensure uninterrupted service.
Troubleshoot Splunk infrastructure issues, including performance bottlenecks, data ingestion problems, and search optimization.
Create and maintain documentation, including architecture diagrams, installation guides, and troubleshooting procedures.
Collaborate with security, network, and system administrators to integrate Splunk within the IT infrastructure.
Onboard and normalize data, including routing, parsing, and mapping events to the Splunk Common Information Model (CIM).
Integrate third-party software APIs to configure connections and retrieve data.
Prioritize work autonomously and deliver results.