SRE Splunk Enterprise Administrator – (w/ active Secret)

Critical Solutions•Norfolk, VA

2d•Onsite

About The Position

Critical Solutions is seeking an SRE Splunk Enterprise Administrator to support a federal customer. This role is part of the Site Reliability Engineers (SRE) supporting mission-critical cybersecurity operations. The administrator maintains distributed Splunk Enterprise platforms across hybrid cloud and on-premises environments, handling daily operations, performance and ingestion monitoring, data onboarding support, incident troubleshooting, security compliance, documentation, and modernization activities in an Agile/DevOps operating culture. The position is onsite in Norfolk, Virginia, Monday through Friday on the day shift. After-hours support and participation in an on-call rotation are required as needed. The selected candidate must hold an active DoD Secret clearance or higher, be a U.S. citizen, and pass the federal agency’s background investigation and fingerprinting requirements.

Requirements

U.S. citizenship and an active DoD Secret Security Clearance or higher.
Bachelor’s degree with prior relevant experience or a master’s degree with prior relevant experience.
Minimum DoD 8570.01 IAT Level II certification.
Splunk Enterprise Certified Admin or Splunk Cloud Certified Admin certification.
At least three years of experience administering Splunk Enterprise v9 and supporting distributed Splunk architectures in hybrid cloud and on-premises production environments.
Experience administering and troubleshooting Red Hat Enterprise Linux (RHEL) 8 and/or RHEL 9 servers.
Experience with STIGs, the Risk Management Framework (RMF), vulnerability management, and compliance frameworks.
Experience developing and maintaining operational dashboards, visualizations, and executive reporting in Splunk Enterprise and Splunk Cloud.
Strong working knowledge of Splunk data ingestion pipelines, indexing, parsing, forwarding, search optimization, and retention management.
Experience using at least one scripting or automation language: Python, Bash, or PowerShell.
Strong troubleshooting, analytical, communication, and documentation skills.
Ability to work independently, manage competing priorities, collaborate across technical teams, and maintain a customer-focused approach in a high-tempo production environment.
Ability to work onsite at Norfolk Station Monday through Friday on the day shift.
Ability to participate in after-hours support and an on-call rotation as required.
Must undergo and successfully pass the federal agency background investigation and fingerprinting.

Nice To Haves

Experience with automated script design, coding, debugging, and maintenance using Bash, Python, or similar tools.
Experience working in classified government or Department of Defense environments.
Familiarity with RHEL 10.

Responsibilities

Administer, maintain, and perform daily operations and maintenance for distributed Splunk Enterprise environments, including Search Heads, Indexers, Heavy Forwarders, Intermediate Forwarders, Universal Forwarders, and Deployment Servers across hybrid cloud and on-premises infrastructure.
Monitor platform health, data ingestion, indexing throughput, search performance, and retention utilization.
Troubleshoot data onboarding, parsing, field extraction, forwarding, indexing, and ingestion issues.
Support Splunk Cloud integrations and associated hybrid operational activities.
Maintain Splunk applications, dashboards, alerts, saved searches, and knowledge objects.
Support patching, vulnerability remediation, STIG compliance, and system hardening activities.
Support platform upgrades, migrations, infrastructure modernization, technology refresh, and automation initiatives using scripting and configuration-management tools.
Participate in incident response, outage troubleshooting, problem resolution, and root cause analysis.
Maintain operational documentation, architecture diagrams, runbooks, and standard operating procedures.
Coordinate with cybersecurity, network, server, engineering, and customer teams during operational and modernization activities.
Participate in after-hours support and an on-call rotation as required.