Senior Splunk Engineer

emagine; Manaus; Presencial; BRL 90.000 - 110.000; Tempo integral

Resumo da oferta

A technology and consulting firm located in Manaus, Brazil, is seeking an experienced Senior Splunk Engineer to operate and enhance an enterprise-scale Splunk SIEM platform. This role involves managing all aspects of Splunk operations, including log onboarding, incident management, and security compliance. Candidates should have 5–10 years of experience in large enterprises, possess strong scripting skills in Terraform and Ansible, and have relevant Splunk certifications. Fluency in English is a must.

Qualificações

• 5–10 years of experience in Splunk/SIEM in large enterprises.
• Proven expertise in Splunk Architecture and CIM onboarding.
• Strong scripting skills in Terraform and Ansible.

Responsabilidades

• Perform CIM-compliant log onboarding and parser creation.
• Ensure full Splunk platform operation and monitoring.
• Manage Splunk patching and releases effectively.

Conhecimentos

Splunk/SIEM experience

Splunk Architecture

Parser development

Strong scripting

Clear documentation skills

Fluent English

Ferramentas

Terraform

Ansible

Bash/Python

Syslog-ng

Descrição da oferta de emprego

Overview

We are seeking an experienced Senior Splunk Engineer to take over and operate the on-premise Splunk SIEM platform. As part of the transition from Infosys, you will be responsible for stabilizing and continuously improving an existing enterprise‑scale SIEM environment.

You will own all Splunk operations across Plan & Build, 24/7 Operations, Release & Patch Management, CIM-based Log Onboarding, Parser development, Hardening, Configuration Management, and Incident/Problem/Change processes.

Responsibilities

1. Plan & Build

• Perform CIM-compliant log onboarding, parser creation, documentation.
• Conduct onboarding due diligence and demand analysis.
• Create Firewall/VPN/Routing change requests and validate changes.
• Manage ingestion pipelines via Cribl, Syslog-ng (TLS), Splunk UF/HF, SCP.
• Deploy and scale Splunk components using Terraform and Ansible.
• Build trend and capacity analyses.

2. Operations (24/7 enterprise-grade operations)

• Ensure full Splunk platform operation, monitoring, performance, EPS/log flow.
• Handle Incidents, Service Requests, Changes, and Problems under MBG ITSM.
• Lead Major Incident Management (P1/P2) with 24/7 on-call rotation.
• Build and operate Health Check dashboards and QA reports.

3. Configuration & Release Management

• Implement approved changes across Splunk components.
• Perform daily configuration backups (KV stores, Apps, Configs).
• Maintain automation libraries (Terraform, Ansible, scripts).
• Manage Splunk patching and releases (maintain N-1 level).
• Support up to 12 minor + 1 major release per year.

4. Security, Hardening & Compliance

• System hardening and vulnerability remediation.
• Operate via secure access methods (Jump hosts, SuSSHi, 2FA).
• Conduct vulnerability scans and support SOC threat analysis.
• Automate SOP-based operational workflows.

5. Transition

• Take over existing MBG Splunk operations.
• Validate and enhance current configurations, parsers, and deployments.
• Ensure stability during transition and hypercare.

Requirements

Technical Skills

• 5–10 years Splunk/SIEM experience in large enterprises.
• Expertise in Splunk Architecture, CIM onboarding, parser development, Syslog-ng, certificates.
• Strong scripting: Terraform, Ansible, Bash/Python.
• Experience stabilizing existing SIEM environments.

Certifications (required)

• Splunk Core Certified User
• Splunk Core Certified Power User
• Splunk Enterprise Admin
• Splunk Enterprise Architect
• Optional: Splunk ES

Soft Skills

• Strong communication in enterprise environments.
• Clear documentation skills.
• Proactive, quality-driven work style.
• Fluent English (German beneficial).