Systems Administrator - Splunk SME

Amentum•Fort Meade, MD

1d•$180,000 - $225,000•Onsite

About The Position

Amentum is seeking a Systems Administrator - Splunk SME to support DISA through its Intel and Cyber Division at Fort Meade, Maryland. The role supports mission-critical IT capabilities for the Department of Defense, including engineering, integration, deployment, and sustainment of an enterprise IT solution. The position serves as the technical authority for enterprise Splunk platforms that support log management, security monitoring, mission-system health, and operational analytics across classified networks. The administrator is responsible for platform availability, data integrity, performance, and compliance with Intelligence Community security policy, working with cybersecurity analysts, system owners, network engineers, and mission customers. The position involves administering and improving distributed Splunk environments, including Splunk Enterprise and Enterprise Security, across classified, air-gapped, and cross-domain settings. The administrator builds data ingestion and normalization pipelines, tunes performance and data retention, configures security controls, supports system authorization and incident response, and develops dashboards, searches, alerts, and analytics. The role also includes automation, documentation, Tier 3 escalation support, mentoring junior staff, and participation in technical reviews and change governance. The employee works daily in a SCIF and may work in a datacenter for specified periods. The schedule is eight hours per day, Monday through Friday. An active Top Secret clearance with SCI eligibility is required. This is designated as a safety-sensitive position, and employment is contingent on successful completion of drug screening and compliance with Amentum’s drug and alcohol policies.

Requirements

Active Top Secret clearance with SCI eligibility.
Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, or a related field, or equivalent professional experience; additional relevant experience may substitute for education, typically four additional years in lieu of a degree.
At least 8 years of progressive IT experience, including at least 5 years administering Splunk Enterprise in a large-scale production environment.
Experience working in accredited, access-controlled, or air-gapped environments.
One or more of the following certifications: Splunk Enterprise Certified Architect or a DoD 8570.01-M IAT-II baseline certification.
Expert-level knowledge of Splunk architecture, data lifecycle, and performance tuning.
Demonstrated expertise in indexer and search-head clustering, forwarder management, and distributed Splunk architectures.
Strong proficiency in Search Processing Language (SPL), regular expressions, and data parsing and normalization.
Solid Linux system-administration skills; RHEL/CentOS preferred, with working knowledge of Windows Server.
Working knowledge of networking fundamentals, including TCP/IP, syslog, DNS, and TLS, and of security concepts.
Compliance with DoD 8140 / IC workforce certification requirements, such as Security+ CE or equivalent for the assigned work role, within the required timeframe.
Prior experience in an IC, DoD, or other government cyber environment.
Ability to analyze complex technical problems and deliver reliable solutions under mission-driven timelines.
Strong written and verbal communication skills, including explaining technical concepts to non-technical leaders.
Sound judgment in handling classified information and adherence to security protocols.
Ability to work independently and collaboratively in a multidisciplinary team environment.
Commitment to documentation, process discipline, and continuous improvement.
Ability to work eight hours per day, Monday through Friday, in a SCIF and, as required, in a datacenter.
Successful completion of the required drug-screening process and compliance with company drug and alcohol policies.

Nice To Haves

Splunk Core Certified Consultant certification.
Experience with Splunk Enterprise Security, SOAR, or ITSI.
Experience supporting SOC, cyber threat-hunting, or insider-threat programs.
Experience with configuration-management and automation tools such as Ansible, Git, and CI/CD pipelines.

Responsibilities

Install, configure, upgrade, patch, and maintain Splunk Enterprise and Enterprise Security components, including indexers, search heads, forwarders, deployment servers, cluster managers, license managers, and monitoring consoles.
Administer indexer and search-head clustering to meet availability, retention, and disaster-recovery requirements.
Plan capacity, storage tiering, and data retention based on ingest volumes, search workloads, and mission needs.
Tune Splunk platform performance, including search optimization, data model acceleration, and resource allocation.
Operate Splunk in air-gapped and cross-domain environments, using approved procedures for offline software and content transfers.
Develop and manage data ingestion pipelines from network devices, operating systems, applications, security tools, cloud services, and custom mission systems.
Create and maintain props, transforms, field extractions, source types, and Common Information Model mappings to normalize data.
Manage data quality and forwarder health, and troubleshoot ingestion anomalies, gaps, and latency.
Implement role-based access controls, index-level segregation, and need-to-know data compartmentation.
Ensure the Splunk environment complies with applicable IC and DoD standards, including ICD 503, NIST SP 800-53, RMF, and DISA STIGs.
Support system authorization by producing and maintaining security documentation, configuration baselines, and evidence artifacts.
Configure audit logging, authentication such as PKI/CAC, SAML, and LDAP/AD integration, and encryption of data in transit and at rest.
Remediate vulnerabilities and implement findings from scans, inspections, and audits within required timelines.
Build and maintain dashboards, reports, alerts, correlation searches, and Splunk apps/add-ons for SOC, insider threat, system health, and mission analytics use cases.
Partner with analysts to translate operational requirements into SPL searches and detection logic.
Support incident response with rapid search, data retrieval, and forensic timeline support.
Automate administration and deployment tasks using scripting and configuration-management tools such as Python, Bash, PowerShell, and Ansible.
Maintain operational runbooks, SOPs, architecture diagrams, and change-management records.
Provide Tier 3 escalation support and mentor junior administrators and analysts.
Participate in change control boards, technical working groups, and design reviews; brief leadership on platform status, risks, and roadmap.
Evaluate emerging Splunk capabilities and recommend improvements to enterprise logging and analytics strategy.
Contribute to safety, quality, procedure-compliance, training, and emergency-response responsibilities as applicable.