SIEM Engineer / Splunk

Harvey Nash; Brussel Hoofdstad; On-site; EUR 70,000 - 90,000; Full time

Job summary

Harvey Nash is seeking an experienced SIEM Data Onboarding Engineer to support the integration of new data sources into our Splunk‑based SIEM platform. You will work with security operations, infrastructure, application, and business teams to onboard, normalize, and map logs to CIM.

Experience with Cribl is highly desirable as it helps optimize data flows into Splunk. Strong scripting in Python or PowerShell, and familiarity with JSON, XML, Syslog, REST APIs are valued, along with documenting

Qualifications

• Experience onboarding diverse log sources into Splunk.
• Ability to design and implement data ingestion pipelines.
• Knowledge of Splunk CIM and SPL.
• Experience with Cribl Stream is a plus.

Responsibilities

• Lead and execute onboarding of new log and telemetry sources into Splunk.
• Gather technical requirements from stakeholders and source system owners.
• Design and implement data ingestion pipelines.
• Configure, validate, and troubleshoot data collection mechanisms.
• Ensure logs are properly parsed, normalized, and mapped to the Splunk CIM, where applicable.
• Develop and maintain onboarding documentation, data flow diagrams, and operational procedures.
• Work with cybersecurity teams to understand use cases and ensure onboarding supports detection and monitoring requirements.
• Perform data quality assessments and resolve ingestion issues.
• Optimize data flows to improve performance, scalability, and cost efficiency.
• Support onboarding of cloud, infrastructure, network, security, and application data sources.
• Contribute to continuous improvement of the SIEM data onboarding framework and standards.

Skills

Splunk Enterprise/Cloud

Data onboarding

SPL

Cribl

Python/PowerShell

Log normalization

Stakeholder communication

Ingestion troubleshooting

Tools

Cribl Stream

Splunk Universal/Heavy Forwarders

Splunk CIM

Job description

We are seeking an experienced SIEM Data Onboarding Engineer to support the integration of new data sources into our Splunk-based Security Information and Event Management (SIEM) platform. The consultant will work closely with security operations, infrastructure, application, and business teams to ensure log sources are onboarded efficiently, normalized appropriately, and aligned with security monitoring requirements.

Experience with Cribl is highly desirable, as it is used to optimize, route, transform, and manage telemetry data flows into Splunk.

Key Responsibilities

• Lead and execute onboarding of new log and telemetry sources into Splunk.
• Gather technical requirements from stakeholders and source system owners.
• Design and implement data ingestion pipelines.
• Configure, validate, and troubleshoot data collection mechanisms.
• Ensure logs are properly parsed, normalized, and mapped to the Splunk Common Information Model (CIM), where applicable.
• Develop and maintain onboarding documentation, data flow diagrams, and operational procedures.
• Work with cybersecurity teams to understand use cases and ensure onboarding supports detection and monitoring requirements.
• Perform data quality assessments and resolve ingestion issues.
• Optimize data flows to improve performance, scalability, and cost efficiency.
• Support onboarding of cloud, infrastructure, network, security, and application data sources.
• Contribute to continuous improvement of the SIEM data onboarding framework and standards.

Required Skills & Experience

Splunk

• Strong hands-on experience with Splunk Enterprise and/or Splunk Cloud.
• Experience onboarding and managing diverse log sources.
• Knowledge of Universal Forwarders, Heavy Forwarders, Data Inputs, index management, source types, field extractions, Splunk CIM, and Search Processing Language (SPL).
• Experience troubleshooting data ingestion and parsing issues.

SIEM & Security

• Good understanding of SIEM concepts and security monitoring.
• Familiarity with security logs from operating systems (Windows/Linux), network devices, security appliances, cloud platforms (Azure, AWS, GCP), applications, and middleware.
• Understanding of log management and event correlation principles.
• Experience with log transport technologies and ingestion architectures.
• Understanding of JSON, XML, Syslog, REST APIs, and event streaming concepts.
• Experience with scripting or automation using Python, PowerShell, or similar technologies.

Preferred Qualifications

Cribl

• Hands-on experience with Cribl Stream and/or related Cribl products.
• Experience creating pipelines, routing rules, transformations, and filtering logic.
• Knowledge of observability and telemetry optimization practices.
• Experience reducing SIEM ingestion costs through data engineering techniques.
• Understanding of SOC operations and detection engineering.
• Experience working in enterprise-scale environments.
• Knowledge of cloud-native logging and monitoring services.

Profile

• Strong analytical and troubleshooting skills.
• Ability to work independently with limited supervision.
• Excellent stakeholder management and communication skills.
• Comfortable working across infrastructure, security, and application teams.
• Documentation-oriented with strong attention to detail.
• Fluent in English; Dutch and/or French are a plus.

The ideal service deliverer has extensive experience onboarding complex data sources into Splunk environments and can independently drive integration activities from requirements gathering through production deployment. Experience with Cribl and large-scale SIEM environments will be considered a significant advantage