Splunk Engineer

Fuse Engineering LLC • Laurel, MD

2d

About The Position

The Splunk Engineer is responsible for the design, implementation, optimization, and sustainment of enterprise logging, monitoring, and security analytics solutions. The role ensures Splunk environments meet availability, performance, compliance, and audit requirements.

The engineer develops and maintains dashboards and logging infrastructure for security events, audit data, user activity monitoring, compliance and vulnerability data, network and system events, containerized application events, mission metrics, outages, and system/network utilization. The role also supports data integrations, log retention, Splunk performance and scale, advanced technical support, security configuration advice, and automation to improve alert fidelity.

Requirements

• TS/SCI with Polygraph clearance required.
• Splunk Enterprise architecture and administration.
• Security logging, SIEM design, and compliance reporting.
• Linux systems administration.
• Data onboarding, including Syslog, NetFlow, and API ingestion.
• Scripting with Python, Bash, and SPL.

Responsibilities

• Design, develop, and sustain custom Splunk dashboards and analytics supporting security events, audit data, user activity monitoring, STE/STN compliance, vulnerability and compliance scans, network/system observable events by SSP, containerized application events by namespace, mission metrics, outage tracking, and system/network utilization.
• Ensure Splunk dashboards and logging infrastructure maintain 93% operational availability monthly.
• Develop and maintain dashboards for authentication events, privileged access, account management, role escalation, and container security events.
• Integrate data from NetFlow/sFlow, Syslog, Cribl, Nagios, HP NNMi, HPNA, vulnerability scanners, and compliance tools.
• Perform Splunk scaling, performance tuning, data onboarding, and index management.
• Maintain log retention policies providing 30 days of online searchable logs and 5 years, 11 months of offline retention with restore capability.
• Provide Tier-4 support, including vendor escalation and coordination with Splunk engineering.
• Advise architects and security accreditors on Splunk security configurations and audit capabilities.
• Develop automation, parsing, and enrichment logic to reduce false positives and enhance alert fidelity.

What This Job Offers

• Job Type: Full-time
• Education Level: No Education Listed