Splunk Administrator

Booz Allen Hamilton•Indian Head, MD

4d•$62,000 - $141,000

About The Position

The Splunk Administrator administers, configures, and maintains Splunk Enterprise on Linux-based systems in support of mission-critical U.S. Navy client work. The role focuses on designing and managing Splunk infrastructure, troubleshooting and optimizing performance, supporting information assurance and incident response, and helping protect critical digital infrastructure. The administrator collaborates with security and operations teams to define logging and monitoring strategies, and communicates technical security issues to audiences including senior management.

Requirements

At least 3 years of experience in Information Assurance Compliance, including administering and managing Splunk Enterprise environments on Linux-based systems.
Experience configuring and managing Splunk distributed infrastructures, including indexers, search heads, and forwarders.
Knowledge of Linux system administration, performance tuning, and troubleshooting, such as Red Hat or CentOS.
Knowledge of scripting for automation and system management, including Bash and Python.
Knowledge of Splunk Search Processing Language (SPL) for data analysis and query optimization.
Ability to monitor, troubleshoot, and optimize Splunk performance in Linux environments; apply security best practices to Splunk and Linux systems; collaborate; and communicate complex technical issues effectively.
Secret clearance required.
Bachelor's degree.
Ability to obtain a Splunk certification, such as Splunk Certified Admin or Splunk Certified Power User, before the start date.
Ability to obtain an IAT Level II certification before the start date.

Nice To Haves

Experience with advanced cybersecurity concepts or enterprise-level security architecture.
Experience researching, evaluating, or adopting emerging technologies to enhance system security or operational capabilities.
Knowledge of advanced security frameworks or methodologies such as Zero Trust, RMF, or NIST 800-53.
Ability to solve complex technical problems through analytical thinking and structured troubleshooting.
Ability to apply industry best practices to improve system reliability, efficiency, or automation.
Linux certification such as RHCSA or LPIC-2.

Responsibilities

Administer, configure, and maintain Splunk Enterprise on Linux-based systems.
Install and configure Splunk forwarders, indexers, and search heads.
Design, implement, and manage Splunk infrastructure on Linux servers.
Troubleshoot and optimize Splunk performance in Linux environments.
Configure and manage Splunk apps, add-ons, and integrations with third-party data sources.
Monitor Splunk health, conduct regular backups, and implement disaster recovery procedures.
Collaborate with security and operations teams to define logging and monitoring strategies.
Secure Splunk infrastructure by implementing access controls, encryption, and security best practices.
Perform updates, patches, and upgrades for Splunk and Linux systems.
Develop and maintain automation scripts for monitoring, backups, and system configurations.
Support incident response, reporting, and debugging within Splunk environments.
Perform information assurance duties as assigned.
Build relationships with other teams and communicate complex security matters to varied audiences, including senior management.