Senior Splunk Engineer

emagine; Maringá; Presencial; BRL 120.000 - 160.000; Tempo integral

Resumo da oferta

A technology solutions provider in Brazil is seeking an experienced Senior Splunk Engineer to manage and enhance their on-premise Splunk SIEM platform. Responsibilities include log onboarding, incident management, and configuration management. Candidates should have 5–10 years of SIEM experience, strong skills in Splunk architecture, scripting in Terraform and Ansible, and experience with certifications. Strong communication in English is required, and proficiency in German is a plus.

Qualificações

• 5–10 years of experience in Splunk/SIEM within large enterprises.
• Expertise in Splunk architecture and CIM onboarding.
• Strong scripting capabilities in Terraform, Ansible, Bash, and Python.
• Experience in stabilizing and managing SIEM environments.

Responsabilidades

• Operate and enhance the on-premise Splunk SIEM platform.
• Perform log onboarding and parser creation.
• Manage ingestion pipelines and deployment using Terraform and Ansible.
• Ensure platform operation and handle incidents under ITSM standards.
• Conduct system hardening and vulnerability remediation.

Conhecimentos

Splunk / SIEM experience

Terraform

Ansible

Bash

Python

Communication

Documentation skills

Proactive work style

Fluent English

Formação académica

Two relevant Splunk certifications

Ferramentas

Splunk

Syslog-ng

Descrição da oferta de emprego

Overview

We are seeking an experienced Senior Splunk Engineer to take over and operate the on-premise Splunk SIEM platform.

As part of the transition from Infosys, you will be responsible for stabilizing and continuously improving an existing enterprise-scale SIEM environment.

Responsibilities

Plan & Build

• Perform CIM-compliant log onboarding, parser creation, and documentation.
• Conduct onboarding due diligence and demand analysis.
• Create firewall, VPN, and routing change requests and validate changes.
• Manage ingestion pipelines via Cribl, Syslog-ng (TLS), Splunk UF/HF, and SCP.
• Deploy and scale Splunk components using Terraform and Ansible.
• Build trend and capacity analyses.

Operations (24/7 Enterprise-Grade Operations)

• Ensure full Splunk platform operation, monitoring, performance, EPS / log flow.
• Handle incidents, service requests, changes, and problems under MBG ITSM.
• Lead major incident management (P1/P2) with 24/7 on‑call rotation.
• Build and operate health‑check dashboards and QA reports.

Configuration & Release Management

• Implement approved changes across Splunk components.
• Perform daily configuration backups (KV stores, apps, and configs).
• Maintain automation libraries (Terraform, Ansible, and scripts).
• Manage Splunk patching and releases (maintain N-1 level).
• Support up to 12 minor and one major release per year.

Security, Hardening & Compliance

• System hardening and vulnerability remediation.
• Operate via secure access methods (Jump hosts, SuSSHi, 2FA).
• Conduct vulnerability scans and support SOC threat analysis.
• Automate SOP-based operational workflows.

Transition

• Take over existing MBG Splunk operations.
• Validate and enhance current configurations, parsers, and deployments.
• Ensure stability during transition and hyper‑care.

Requirements

Technical Skills

5–10 years Splunk / SIEM experience in large enterprises.

Expertise in Splunk architecture, CIM onboarding, parser development, Syslog-ng, and certificates.

Strong scripting : Terraform, Ansible, Bash, and Python.

Experience stabilizing existing SIEM environments.

Certifications (required)

Minimum two of:

• Splunk Core Certified User
• Splunk Core Certified Power User
• Splunk Enterprise Admin
• Splunk Enterprise Architect

Optional : Splunk ES

Soft Skills

Strong communication in enterprise environments.

Clear documentation skills.

Proactive, quality‑driven work style.

Fluent English (German beneficial).