Splunk SIEM Data Onboarding Engineer | Cribl Expert

Harvey Nash; Brussel Hoofdstad; On-site; EUR 70,000 - 90,000; Full time

Job summary

Harvey Nash is seeking an experienced SIEM Data Onboarding Engineer to support the integration of new data sources into our Splunk‑based SIEM platform. You will work with security operations, infrastructure, application, and business teams to onboard, normalize, and map logs to CIM.

Experience with Cribl is highly desirable as it helps optimize data flows into Splunk. Strong scripting in Python or PowerShell, and familiarity with JSON, XML, Syslog, REST APIs are valued, along with documenting

Qualifications

• Experience onboarding diverse log sources into Splunk.
• Ability to design and implement data ingestion pipelines.
• Knowledge of Splunk CIM and SPL.
• Experience with Cribl Stream is a plus.

Responsibilities

• Lead and execute onboarding of new log and telemetry sources into Splunk.
• Gather technical requirements from stakeholders and source system owners.
• Design and implement data ingestion pipelines.
• Configure, validate, and troubleshoot data collection mechanisms.
• Ensure logs are properly parsed, normalized, and mapped to the Splunk CIM, where applicable.
• Develop and maintain onboarding documentation, data flow diagrams, and operational procedures.
• Work with cybersecurity teams to understand use cases and ensure onboarding supports detection and monitoring requirements.
• Perform data quality assessments and resolve ingestion issues.
• Optimize data flows to improve performance, scalability, and cost efficiency.
• Support onboarding of cloud, infrastructure, network, security, and application data sources.
• Contribute to continuous improvement of the SIEM data onboarding framework and standards.

Skills

Splunk Enterprise/Cloud

Data onboarding

SPL

Cribl

Python/PowerShell

Log normalization

Stakeholder communication

Ingestion troubleshooting

Tools

Cribl Stream

Splunk Universal/Heavy Forwarders

Splunk CIM

Job description

Harvey Nash is seeking an experienced SIEM Data Onboarding Engineer to support the integration of new data sources into our Splunk‑based SIEM platform. You will work with security operations, infrastructure, application, and business teams to onboard, normalize, and map logs to CIM.

Experience with Cribl is highly desirable as it helps optimize data flows into Splunk. Strong scripting in Python or PowerShell, and familiarity with JSON, XML, Syslog, REST APIs are valued, along with documenting