Senior Splunk Engineer

emagine; Contagem; Presencial; BRL 120.000 - 160.000; Tempo integral

Resumo da oferta

A technology solutions provider is looking for a Senior Splunk Engineer in Contagem, Minas Gerais, Brazil. This role involves managing the on-premise Splunk SIEM platform with a focus on stabilization and improvement. Key qualifications include 5–10 years experience in Splunk/SIEM, strong scripting skills in Terraform and Ansible, and necessary certifications. The ideal candidate will also demonstrate strong communication skills and a proactive work style. This position is critical for ensuring operational efficiency in enterprise-grade environments.

Qualificações

• 5–10 years of Splunk/SIEM experience in large enterprises.
• Expertise in Splunk architecture and CIM onboarding.
• Strong scripting skills in Terraform, Ansible, Bash, and Python.
• Experience stabilizing existing SIEM environments.

Responsabilidades

• Operate and manage the on-premise Splunk SIEM platform.
• Perform CIM-compliant log onboarding, parser creation.
• Ensure continuous improvement for the existing SIEM environment.
• Lead major incident management with 24/7 on-call rotation.

Conhecimentos

Splunk / SIEM experience

Terraform

Ansible

Bash

Python

Strong communication

Clear documentation

Proactive work style

Fluent English

Formação académica

Splunk Core Certified User

Splunk Core Certified Power User

Splunk Enterprise Admin

Splunk Enterprise Architect

Descrição da oferta de emprego

Overview

We are seeking an experienced Senior Splunk Engineer to take over and operate the on-premise Splunk SIEM platform.

As part of the transition from Infosys, you will be responsible for stabilizing and continuously improving an existing enterprise-scale SIEM environment.

Responsibilities

Plan & Build

• Perform CIM-compliant log onboarding, parser creation, and documentation.
• Conduct onboarding due diligence and demand analysis.
• Create firewall, VPN, and routing change requests and validate changes.
• Manage ingestion pipelines via Cribl, Syslog-ng (TLS), Splunk UF/HF, and SCP.
• Deploy and scale Splunk components using Terraform and Ansible.
• Build trend and capacity analyses.

Operations (24/7 Enterprise-Grade Operations)

• Ensure full Splunk platform operation, monitoring, performance, EPS / log flow.
• Handle incidents, service requests, changes, and problems under MBG ITSM.
• Lead major incident management (P1/P2) with 24/7 on‑call rotation.
• Build and operate health‑check dashboards and QA reports.

Configuration & Release Management

• Implement approved changes across Splunk components.
• Perform daily configuration backups (KV stores, apps, and configs).
• Maintain automation libraries (Terraform, Ansible, and scripts).
• Manage Splunk patching and releases (maintain N-1 level).
• Support up to 12 minor and one major release per year.

Security, Hardening & Compliance

• System hardening and vulnerability remediation.
• Operate via secure access methods (Jump hosts, SuSSHi, 2FA).
• Conduct vulnerability scans and support SOC threat analysis.
• Automate SOP-based operational workflows.

Transition

• Take over existing MBG Splunk operations.
• Validate and enhance current configurations, parsers, and deployments.
• Ensure stability during transition and hyper‑care.

Requirements

Technical Skills

5–10 years Splunk / SIEM experience in large enterprises.

Expertise in Splunk architecture, CIM onboarding, parser development, Syslog-ng, and certificates.

Strong scripting : Terraform, Ansible, Bash, and Python.

Experience stabilizing existing SIEM environments.

Certifications (required)

Minimum two of:

• Splunk Core Certified User
• Splunk Core Certified Power User
• Splunk Enterprise Admin
• Splunk Enterprise Architect

Optional : Splunk ES

Soft Skills

Strong communication in enterprise environments.

Clear documentation skills.

Proactive, quality‑driven work style.

Fluent English (German beneficial).