Splunk Architect

Definitive Innovative Solutions•Oakton, VA

1d•$150 - $200

About The Position

Definitive Innovative Solutions (DIS) is seeking a highly skilled Splunk Architect to lead the design, implementation, modernization, and optimization of enterprise Splunk platforms supporting mission-critical cybersecurity, operational, and analytics requirements for a federal customer. The role serves as the technical architect and subject matter expert for the customer's enterprise Splunk environment and supports security monitoring, operational analytics, and mission requirements. The architect designs, implements, and maintains scalable Splunk architectures and infrastructure; develops data ingestion strategies and data models; and creates and optimizes SPL searches, reports, dashboards, alerts, and correlation searches. The position supports security detections and use cases, integrates Splunk with security and enterprise technologies, and designs Splunk Enterprise Security capabilities as applicable. It also involves platform health and capacity management, complex troubleshooting, automation, upgrades and migrations, technical documentation, and compliance with federal security requirements and customer policies. The role collaborates with government personnel, contractors, system owners, cybersecurity personnel, and technical stakeholders. It supports cybersecurity assessments, audits, ATO activities, continuous monitoring, technical reviews, and change-control activities, while providing mentoring and knowledge transfer to other technical personnel. The position is based in Oakton, Virginia, requires an active Top Secret clearance with eligibility for SCI, and may require onsite work at the customer location when required by the contract.

Requirements

Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related technical discipline and 8 years of relevant experience, or an equivalent combination of education and experience.
5 or more years of hands-on Splunk experience in an enterprise environment.
Demonstrated experience designing, implementing, administering, and troubleshooting Splunk environments.
Demonstrated experience developing Splunk searches, dashboards, alerts, reports, and data integrations using SPL.
Demonstrated experience with enterprise log ingestion and data onboarding from multiple technology platforms.
Demonstrated experience with Splunk architecture components, including forwarders, indexers, search heads, and deployment/configuration management.
Demonstrated experience supporting cybersecurity, SIEM, SOC, or security monitoring operations.
Experience with Linux and/or Windows operating systems in an enterprise environment.
Ability to successfully complete required background investigations, suitability determinations, and customer-specific security requirements.
Ability to work onsite at the customer location when required by the contract.
Active Top Secret clearance with eligibility for Sensitive Compartmented Information (SCI).

Nice To Haves

Splunk Enterprise Architect, Splunk Core Certified Consultant, Splunk Enterprise Certified Admin, Splunk Enterprise Security Certified Admin, or comparable Splunk certification.
Experience with Splunk Enterprise Security (ES).
Experience with Splunk SOAR.
Experience implementing Risk-Based Alerting (RBA).
Experience developing cybersecurity detection and monitoring use cases.
Experience integrating Splunk with cloud environments, particularly Microsoft Azure or AWS.
Experience with Splunk on-premises, cloud, or hybrid architectures.
Experience supporting federal civilian, Department of Defense, or Intelligence Community customers.
Experience with federal cybersecurity frameworks and requirements, including NIST, FISMA, RMF, FedRAMP, STIGs, and applicable agency security policies.
Experience with infrastructure-as-code, configuration management, or automation technologies such as Ansible, Terraform, or Git.
Experience with APIs and scripting languages such as Python, PowerShell, or Bash.

Responsibilities

Serve as the technical architect and subject matter expert for the customer's enterprise Splunk environment.
Design, implement, and maintain scalable Splunk architectures supporting enterprise security monitoring, operational analytics, and mission requirements.
Develop and maintain Splunk infrastructure, including indexers, search heads, deployment servers, forwarders, and associated platform components.
Develop architecture standards, technical designs, configuration standards, and implementation plans for Splunk capabilities.
Design and implement data ingestion strategies from network, security, infrastructure, application, cloud, endpoint, and other enterprise sources.
Develop and maintain Splunk data models, indexes, sourcetypes, field extractions, parsing rules, and data normalization strategies.
Develop and optimize SPL searches, reports, dashboards, alerts, and correlation searches.
Support development and tuning of security detections, use cases, and analytics in coordination with SOC and cybersecurity teams.
Integrate Splunk with security and enterprise technologies, including SIEM/SOAR platforms, endpoint security, vulnerability management, identity and access management, network security, cloud platforms, and ticketing systems.
Design and implement Splunk Enterprise Security capabilities, including correlation searches, notable events, risk-based alerting, dashboards, and security monitoring workflows, as applicable.
Analyze Splunk performance, capacity, indexing rates, search performance, storage utilization, and system health; recommend and implement optimization measures.
Establish and maintain Splunk health, availability, performance, and capacity monitoring.
Troubleshoot complex Splunk infrastructure, ingestion, search, integration, and performance issues.
Develop automation and repeatable processes to improve Splunk administration, deployment, configuration management, and operational efficiency.
Support Splunk upgrades, migrations, architecture modernization, and technology refresh activities.
Evaluate new Splunk capabilities and recommend enhancements based on customer mission requirements.
Maintain technical documentation, including architecture diagrams, configuration standards, data source inventories, operating procedures, and troubleshooting guides.
Ensure Splunk architecture and implementation comply with applicable federal security requirements, customer policies, configuration standards, and contract requirements.
Support cybersecurity assessments, audits, ATO activities, continuous monitoring, and security control implementation as required.
Collaborate with government personnel, contractors, system owners, cybersecurity personnel, and technical stakeholders to identify requirements and resolve technical issues.
Participate in technical reviews, design sessions, change-control activities, and engineering working groups.
Provide technical mentoring and knowledge transfer to Splunk administrators, engineers, analysts, and other technical personnel.
Identify opportunities to improve system reliability, scalability, security, automation, and operational efficiency.
Perform other duties as assigned in support of contract and program objectives.