SIEM Platform Engineer (DoD TS Clearance)

MartinFed•Washington, DC

3d•Onsite

About The Position

The SIEM Platform Engineer is responsible for the architecture, deployment, and ongoing health of the Splunk platform that underpins security operations across government agencies. This role owns the underlying infrastructure - indexers, search heads, forwarders, and clustering - and ensures the environment is performant, resilient, secure, and scalable. The Platform Engineer partners with Data and Detection Engineers, IT teams, and stakeholders to deliver a stable foundation on which data ingestion and threat detection depend.

Requirements

US Citizen with an active Top Secret Security Clearance.
Bachelor's degree in Computer Science or a related field plus 6 years of related experience.
Proven experience designing, deploying, and administering distributed and clustered Splunk environments, preferably within government or enterprise settings.
Strong understanding of Splunk architecture, indexer/search head clustering, forwarder management, and licensing.
Experience with capacity planning, performance tuning, and platform upgrades.
Familiarity with security standards and regulations (NIST, FISMA, etc.) applicable to platform operation and accreditation.
Excellent problem-solving skills and the ability to diagnose and resolve complex technical issues.
Strong written and verbal communication skills.

Nice To Haves

Splunk Enterprise Certified Admin or Architect certification preferred.

Responsibilities

Design, deploy, and maintain Splunk environments, including indexer clusters, search head clusters, and forwarder tiers, to support enterprise-scale data collection and analysis.
Architect distributed and clustered deployments for high availability and disaster recovery.
Optimize Splunk configurations to ensure efficient data storage, indexing, retrieval, and search performance.
Manage index and storage design, data retention policies, and licensing to balance performance and cost.
Monitor growth trends and forecast capacity needs across compute, storage, and licensing.
Scale the environment proactively to meet increasing data volumes and user demand.
Plan and execute Splunk version upgrades, patching, and platform migrations with minimal disruption.
Manage app and add-on deployment across the environment using deployment servers and configuration management.
Monitor system performance and troubleshoot issues related to indexing, search performance, and resource utilization.
Implement optimizations to enhance the platform's efficiency, stability, and responsiveness.
Implement access controls, role-based access (RBAC), hardening, and best practices to protect the platform and ensure compliance with relevant regulations and standards.
Support audit, accreditation, and continuous monitoring requirements for the environment.
Provide guidance to team members on Splunk platform administration and best practices.
Create and maintain documentation for platform architecture, configurations, and operational procedures.