Splunk Administrator

Booz Allen Hamilton•Usa, MD

About The Position

The Splunk Administrator will administer, configure, and maintain Splunk Enterprise on Linux-based systems in support of mission-critical U.S. Navy work. The role focuses on designing, implementing, and managing Splunk infrastructure, troubleshooting and optimizing system performance, and helping protect critical digital infrastructure. The administrator will work with security and operations teams to develop logging and monitoring strategies, support incident response, and communicate technical security issues to audiences including senior management. The role also includes information assurance duties as assigned.

Requirements

At least 3 years of experience in Information Assurance Compliance, including administering and managing Splunk Enterprise environments on Linux-based systems.
Experience configuring and managing distributed Splunk infrastructures, including indexers, search heads, and forwarders.
Knowledge of Linux system administration, performance tuning, and troubleshooting, such as Red Hat or CentOS.
Knowledge of Bash and Python scripting for automation and system management.
Knowledge of Splunk Search Processing Language (SPL) for data analysis and query optimization.
Ability to monitor, troubleshoot, and optimize Splunk performance in Linux environments.
Ability to apply security best practices to Splunk and Linux systems.
Ability to work collaboratively and communicate complex technical issues effectively.
Secret clearance is required.
Bachelor's degree.
Ability to obtain a Splunk certification, such as Splunk Certified Admin or Splunk Certified Power User, before the start date.
Ability to obtain an IAT Level II certification before the start date.

Nice To Haves

Experience with advanced cybersecurity concepts or enterprise-level security architecture.
Experience researching, evaluating, or adopting emerging technologies to enhance system security or operational capabilities.
Knowledge of advanced security frameworks or methodologies such as Zero Trust, RMF, or NIST 800-53.
Ability to solve complex technical problems through analytical thinking and structured troubleshooting.
Ability to apply industry best practices to improve system reliability, efficiency, or automation.
Linux certification such as RHCSA or LPIC-2.

Responsibilities

Administer, configure, and maintain Splunk Enterprise on Linux-based systems.
Install and configure Splunk forwarders, indexers, and search heads.
Design, implement, and manage Splunk infrastructure on Linux servers.
Troubleshoot and optimize Splunk performance in Linux environments.
Configure and manage Splunk apps, add-ons, and integrations with third-party data sources.
Monitor Splunk health, conduct regular backups, and implement disaster recovery procedures.
Collaborate with security and operations teams to define logging and monitoring strategies.
Secure Splunk infrastructure through access controls, encryption, and security best practices.
Perform updates, patches, and upgrades for Splunk and Linux systems.
Develop and maintain automation scripts for monitoring, backups, and system configurations.
Support incident response, reporting, and debugging within Splunk environments.
Perform information assurance duties as assigned.
Build relationships with other teams and communicate security complexities to varied audiences, including senior management.