SRE Cyber Tools - Splunk Admin.
About The Position
Leidos is seeking a Site Reliability Engineer (SRE) Splunk Enterprise Administrator focused on cyber support for the Navy’s largest IT services program. Under the Service Management, Integration, and Transport (SMIT) program, Leidos delivers the core backbone of the Navy-Marine Corps Intranet, including cybersecurity services, network operations, service desk, and data transport. The team supports the Navy in unifying its shore-based networks and data management to improve capability and service while reducing costs through an enterprise network approach. As part of the SRE organization, this role develops and executes tests focused on system resilience, performance under load, and failure scenarios. The SRE works with other SREs and development teams to create automated testing frameworks that simulate real-world conditions and validate system behavior under normal and stressful conditions. The role supports operation and maintenance of the enterprise network and contributes to robust, scalable services that operate reliably in production. The Splunk Enterprise Administrator administers and maintains distributed Splunk Enterprise platforms across hybrid cloud and on-premises environments in support of mission-critical cybersecurity operations. Responsibilities include daily platform operations, performance and ingestion monitoring, data onboarding support, incident troubleshooting, security compliance, documentation, and modernization activities in an Agile/DevOps operating culture. The position is onsite at Norfolk Naval Station, Monday through Friday on day shift, and includes after-hours support and an on-call rotation as required.
Requirements
- Ability to work onsite at Norfolk Naval Station Monday through Friday on day shift.
- Bachelor’s degree and 8–10 years of prior relevant experience, or a master’s degree and 7 years of prior relevant experience.
- U.S. citizenship and an active Secret Security Clearance.
- Minimum DoD 8570.01 IAT Level II Certification.
- Splunk Enterprise Certified Admin or Splunk Cloud Certified Admin certification.
- At least three years of experience administering Splunk Enterprise v9 and supporting distributed Splunk architectures in hybrid cloud and on-premises production environments.
- Experience administering and troubleshooting Red Hat Enterprise Linux (RHEL) 8 and/or RHEL 9 servers.
- Experience with STIGs, the Risk Management Framework (RMF), vulnerability management, and compliance frameworks.
- Experience developing and maintaining operational dashboards, visualizations, and executive reporting in Splunk Enterprise and Splunk Cloud.
- Strong working knowledge of Splunk data ingestion pipelines, indexing, parsing, forwarding, search optimization, and retention management.
- Experience using at least one scripting or automation language: Python, Bash, or PowerShell.
- Strong troubleshooting, analytical, communication, and documentation skills; ability to work independently, manage competing priorities, collaborate across technical teams, and maintain a customer-focused approach in a high-tempo production environment.
- Ability to work in a team environment and demonstrate analytical and problem-solving skills.
Nice To Haves
- Experience with automated script design, coding, debugging, and maintenance using Bash, Python, or similar tools.
- Experience working in classified government or Department of Defense environments.
- Familiarity with RHEL 10.
Responsibilities
- Administer, maintain, and perform daily operations and maintenance for distributed Splunk Enterprise environments, including Search Heads, Indexers, Heavy Forwarders, Intermediate Forwarders, Universal Forwarders, and Deployment Servers across hybrid cloud and on-premises infrastructure.
- Monitor platform health, data ingestion, indexing throughput, search performance, and retention utilization; troubleshoot data onboarding, parsing, field extraction, forwarding, indexing, and ingestion issues.
- Support Splunk Cloud integrations and associated hybrid operational activities.
- Maintain Splunk applications, dashboards, alerts, saved searches, and knowledge objects.
- Support patching, vulnerability remediation, Security Technical Implementation Guide (STIG) compliance, and system hardening activities.
- Support platform upgrades, migrations, infrastructure modernization, technology refresh, and automation initiatives using scripting and configuration-management tools.
- Participate in incident response, outage troubleshooting, problem resolution, and root cause analysis.
- Maintain operational documentation, architecture diagrams, runbooks, and standard operating procedures (SOPs).
- Coordinate with cybersecurity, network, server, engineering, and customer teams during operational and modernization activities.
- Develop and execute tests focused on system resilience, performance under load, and failure scenarios.
- Work with SRE and development teams to create automated testing frameworks that simulate real-world conditions and validate system behavior.
- Participate in after-hours support and an on-call rotation as required.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
