Splunk Enterprise Security Expert

Cynet Systems•Cary, NC

About The Position

We are seeking a highly skilled Splunk Enterprise Security Expert to provide centralized oversight and authoritative governance of all Splunk knowledge objects across the enterprise SIEM environment. This role is crucial for ensuring consistency, scalability, and effective utilization of Splunk knowledge objects, including saved searches, correlation searches, field extractions, tags, aliases, event types, lookups, macros, data models, workflow actions, and KV store collections. The ideal candidate will have a deep understanding of Splunk Enterprise Security, CIM normalization, and SIEM content engineering, with a proven ability to manage knowledge object governance at scale. You will collaborate with various teams to establish standards, lead promotion pipelines, and serve as the authority for CIM compliance and data model management. This position requires strong technical skills in SPL, Splunk administration, scripting, and CI/CD practices, as well as a background in detection engineering or SOC operations.

Requirements

Bachelor's degree in computer science, Information Systems, Cybersecurity, or equivalent professional experience.
8+ years of hands-on Splunk experience in enterprise environments.
3+ years of direct experience with Splunk knowledge management, CIM normalization, or SIEM content engineering in a large-scale deployment (20+ TB/day).
Deep expertise in Splunk Enterprise Security — correlation search authoring, ES data models, risk-based alerting.
Demonstrated experience managing knowledge object governance at scale across multi-team, multi-app Splunk environments.
Strong proficiency in SPL including complex statistical pipelines, accelerated searches, and macro development.
Experience developing and enforcing enterprise naming conventions and taxonomy standards for Splunk deployments.
Proven ability to create and maintain technical documentation — runbooks, standards guides, architecture documentation.
Background in detection engineering, threat hunting, or SOC operations — understanding of how knowledge objects serve analysts in practice.
Splunk Enterprise (distributed, multi-site, clustered) deep administrative and engineering proficiency.
Splunk Enterprise Security (ES) correlation searches, notable events, risk rules, threat intelligence, asset/identity frameworks.
Splunk Common Information Model (CIM) — advanced normalization across all major data model domains.
SPL (Search Processing Language) — advanced query authoring including tstats, macros, sub-searches, eval functions, streaming/non-streaming commands.
Data Models — design, acceleration management (TSIDX), Pivot support, ES data model dependencies.
Knowledge Objects — full lifecycle mastery: field extractions, lookups (CSV, KV Store), macros, tags, aliases, event types, workflow actions, saved searches, correlation searches.
Splunk Apps & Add-ons — TA development/review, app packaging, deployment via Deployment Server and Deployer.
Splunk Admin Config Service (ACS) and configuration file management (conf files, btool, precedence rules).
Splunk Edge Processor / Ingest Processor — pipeline-level routing and data transformation awareness.
Multi-cloud environments: AWS, Azure, GCP — log source integration, cloud-native telemetry normalization.
Linux and Windows system administration.
Python and Bash/Shell scripting — automation of knowledge object management, API-driven content deployment.
GitHub / GitHub Actions / CI-CD pipelines — knowledge object version control, automated testing, promotion workflows.
MITRE ATT&CK — technique mapping for detection content governance.
NIST CSF / 800-53, CIS Benchmarks — compliance-driven knowledge requirements.
Agile / Scrum methodology for iterative content development.

Nice To Haves

Splunk Core Certified Consultant
Splunk Enterprise Security Certified Admin (SPLK-3001)
Splunk Certified Architect
GIAC (GCIA, GCIH, GCED), or equivalent security certifications.
Experience with Splunk SOAR (Phantom) playbook development, orchestration, and knowledge integration.
Familiarity with Splunk UBA and behavioral analytics model management.
Experience in healthcare or highly regulated industries (HIPAA, Federal (NIST), NYDFS, PCI).
Experience with infrastructure-as-code tools (Ansible, Terraform) for Splunk configuration management.
Proficiency with LLM-powered tooling and AI-assisted automation for knowledge retrieval and content management.
Experience supporting Splunk deployments in environments with 10,000+ users and multi-petabyte data retention.
Familiarity with Kafka, streaming data pipelines, and real-time telemetry routing.

Responsibilities

Provide centralized oversight and authoritative governance of all Splunk knowledge objects across the enterprise SIEM environment, including saved searches, correlation searches, field extractions, tags, aliases, event types, lookups, macros, data models, workflow actions, and KV store collections.
Establish, publish, and enforce enterprise-wide naming conventions for all knowledge object types — ensuring consistent, parseable, and discoverable naming across teams, apps, and deployments.
Conduct regular audits of knowledge object libraries to identify duplicate, orphaned, deprecated, or conflicting objects — retiring obsolete content and consolidating redundant objects across teams and deployments.
Create custom automations to track the ingest of data, the consistent flow of the data, drift of data away from the normalization standards, etc.
Define and maintain a knowledge object registry/catalog that documents ownership, scope, purpose, permissions, and lifecycle stage for each object in the environment.
Collaborate with enterprise Splunk platform teams on permission structures and sharing models — ensuring objects are accessible to the correct roles (read/write/execute) across apps, environments, and user tiers without overexposure.
Lead the promotion pipeline for knowledge objects from development through testing, staging, and production — establishing change control workflows aligned to CI/CD and GitOps practices (GitHub, GitHub Actions).
Serve as the CIM (Common Information Model) authority for the enterprise — defining and maintaining CIM-compliant field mappings across all ingested data sources including endpoints (EDR/AV), network (firewall, proxy, DNS), identity (IAM, AD), cloud (AWS CloudTrail, Azure Monitor, GCP Logging), and application layers.
Design, build, and maintain Splunk data models for Pivot users, ES correlation searches, and accelerated reporting — ensuring alignment to CIM schemas and ES asset/identity frameworks.
Manage data model acceleration strategies (TSIDX, tstats, summary indexing) across all production data models, monitoring for search load, acceleration lag, and coverage gaps.
Define and enforce source-type and index taxonomy standards — establishing lexicographic naming conventions that optimize search performance, configuration priority, and multi-team usability.
Ensure entity zone enrichment (asset zones, network zones, identity tiers) is properly incorporated into data models and asset/identity lookups, supporting tiered risk scoring in Enterprise Security.
Maintain CIM coverage matrices across all logging domains, mapping data model fields to MITRE ATT&CK techniques, detection use cases, and compliance controls.
Design and own the enterprise Splunk knowledge architecture — defining taxonomy hierarchies, content type standards, metadata schemas, and classification frameworks that enable findability, scalability, and governance across all teams.
Develop and maintain a Knowledge Management Standards document covering naming conventions, object lifecycle stages, ownership models, permission templates, CIM mapping standards, and change control procedures.
Establish and chair a Knowledge Governance Working Group composed of representatives from Detection Engineering, SOC Operations, Platform Engineering, Compliance, and key application teams — meeting regularly to review standards, resolve conflicts, and prioritize improvements.
Define content type templates for correlation searches, dashboards, reports, lookups, and macros — providing reusable, pre-approved scaffolding that accelerates new content development while enforcing standards compliance.