Splunk & Cribl Platform Engineer IV
About The Position
The senior Splunk and Cribl Platform Engineer supports a large-scale, highly distributed Splunk Enterprise and Splunk Cloud environment that feeds the bank’s Information Security and SOC teams. This is a production-ownership role focused on platform administration and stability rather than monitoring or dashboard building. The engineer owns production support for Splunk search head and indexer clusters, deployers, deployment servers, and forwarders, ensuring high availability, performance, and resiliency. The role includes incident response, troubleshooting, root cause analysis, service restoration, capacity and risk management, and preventive tuning for Splunk and Cribl. The position enables security and SOC operations by onboarding and normalizing data sources, supporting CIM compliance and field normalization, tuning ingestion pipelines, and building searches, dashboards, and alerts for threat detection and investigations. It also administers Cribl data routing, filtering, enrichment, and cost optimization, while maintaining data integrity and collaborating on data-flow strategies and onboarding standards. The engineer maintains runbooks, SOPs, installation guides, and operational documentation and follows change-management, incident-management, and SLA commitments. The role is hybrid in Richmond, Virginia; Charlotte, North Carolina; or Pennington, New Jersey: four days onsite and one remote day for the first six months, then three days onsite and two remote days.
Requirements
- At least 5 years of hands-on administration of large-scale Splunk Enterprise or Splunk Cloud environments.
- Real Splunk platform administration experience; dashboard or alert building for other applications does not meet this requirement.
- Experience with indexer clustering and search head clustering.
- Experience with universal and heavy forwarder architectures.
- Experience with SmartStore and S3-compatible object storage.
- Proficiency in SPL, search optimization, summary indexing, and data model acceleration.
- Deep experience with security log ingestion and SIEM use cases.
- Ability to lead production incidents, perform root cause analysis, and drive preventive solutions.
- Strong Linux administration skills.
- Cribl administration experience in data routing, filtering, and enrichment; this is required.
- Excellent written and verbal communication skills, including the ability to engage senior stakeholders.
Nice To Haves
- Splunk Enterprise Admin or Enterprise Architect certification.
- Splunk ES and SOAR experience, including Phantom or equivalent; general exposure is sufficient.
- Exposure to cloud logging and security architecture in AWS, Azure, or GCP.
- RHEL and Windows Server administration experience.
- Experience with monitoring, APM, or event-management tools.
- Strong understanding of security, network, system, and database operations.
- Ability to balance multiple priorities in a fast-paced environment.
Responsibilities
- Own end-to-end production support for search head clusters, indexer clusters, deployers, deployment servers, and forwarders.
- Ensure high availability, performance, and resiliency for security and operational use cases.
- Lead incident response, troubleshooting, root cause analysis, and service restoration for Splunk and Cribl.
- Identify risks, capacity constraints, and performance bottlenecks, and implement preventive measures and tuning.
- Enable Information Security and SOC teams by onboarding and normalizing data sources, supporting CIM compliance and field normalization.
- Tune ingestion pipelines using props.conf and transforms.conf.
- Build and support dashboards, searches, and alerts for threat detection and investigations.
- Administer Cribl data routing, filtering, enrichment, and cost optimization.
- Ensure data integrity, reliability, and performance across ingestion pipelines.
- Collaborate with architecture teams on data-flow strategies and onboarding standards.
- Develop and maintain runbooks, SOPs, installation guides, and operational documentation.
- Adhere to change-management, incident-management, and SLA commitments.
- Manage cluster-level issues end to end and investigate data-flow and ingestion issues.
- Operate calmly during high-severity incidents and maintain audit-ready documentation.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Career Level
Senior
Education Level
No Education Listed
