Principal Infrastructure Engineer - Splunk Admin (SIEM)

Silicon Valley Bank; Karnataka; On-site; INR 2,500,000 - 4,500,000; Full time

Job summary

FC Global Services India LLP (First Citizens India) in Bengaluru seeks a senior Splunk Administrator to lead onboarding, data modeling, and CIM alignment for enterprise observability. You will design scalable onboarding pipelines, integrate with SIEM use cases, and collaborate with global teams to ensure reliable monitoring and reporting.

The role requires extensive Splunk experience, strong scripting and automation skills, and a collaborative mindset to drive best practices across platforms.

Qualifications

• Advanced Splunk Enterprise and Splunk Cloud administration.
• Strong knowledge of data models, data model accelerations, and knowledge objects.
• Deep understanding of CIM and data normalization principles.
• Experience with advanced search optimization, lookup tables, and automated lookups.
• Proficiency with Splunk Enterprise Security (ES) and SIEM use cases.
• Knowledge of Splunk Cloud-specific features, limitations, and best practices.
• Understanding of Splunk licensing, data ingestion pipelines, and performance tuning.
• Hands-on experience designing and implementing data ingestion pipelines.
• Expertise in log parsing, data transformation, and field extraction.
• Strong proficiency with Git and collaborative development workflows.
• Hands-on experience with Ansible for infrastructure automation.
• Experience with CI/CD pipelines and automated deployment processes.
• Scripting and automation using Python, Bash, or similar languages.
• Understanding of SIEM platforms and security event management workflows.
• Knowledge of common security use cases (authentication, access control, threat detection, incident response).
• Familiarity with compliance frameworks (SOX, PCI‑DSS, HIPAA) and audit trail requirements.
• Desired knowledge of complementary observability platforms (Dynatrace, SolarWinds, Prometheus, Elastic).
• Minimum 3+ years of hands‑on Splunk Administration and implementation experience.
• Minimum 10+ years of infrastructure, platform engineering, systems administration, or related experience.
• Splunk Certified Admin (SCA), Splunk Certified Power User (SCPU), and Splunk ES certification or coursework completed required; additional certifications preferred.
• Excellent communication skills, positive customer‑focused interpersonal skills, collaboration, ownership, and accountability.
• Financial Services/Banking experience, especially in Large Financial Institutions or complex environments preferred.
• BE or MCA degree in computer science or related field.

Responsibilities

• Design and implement standardized onboarding procedures for applications.
• Onboard data into Splunk Cloud: inputs, parsing rules, CIM mappings.
• Build data models, lookups, and knowledge objects for reporting and alerts.
• Develop automated onboarding pipelines with Git, Ansible, and CI/CD.
• Enforce tagging conventions and data organization across apps.
• Collaborate with Business Analysts to translate requirements into specs.
• Work with Splunk Data Admins to enable scalable onboarding.
• Provide guidance on best practices and use cases for Splunk users.

Skills

Splunk Admin

CIM data model

Git workflows

Ansible automation

Python scripting

CI/CD pipelines

SIEM use cases

Communication skills

Splunk ES

Education

BE or MCA in CS or related

Tools

Splunk Cloud

Splunk Enterprise

Git

Ansible

Dynatrace

SolarWinds

Prometheus

Elastic

Job description

Overview

First Citizens India, a global capability center (GCC) based in Bengaluru, part of First Citizens BancShares, Inc., a top 20 U.S. financial institution. The India-based teams benefit from the company’s over 125-year legacy of strength and stability.

Key Responsibilities

• Design and implement standardized data onboarding procedures and configurations for applications; establish repeatable patterns and templates.
• Conduct technical onboarding of applications into Splunk Cloud: configure data inputs, create parsing rules, establish field extractions, and build data models.
• Map application data and security events to the Splunk Common Information Model (CIM); identify and document relevant SIEM use cases.
• Build and optimize data models, lookups, and knowledge objects to support reporting, alerting, rule creation, and compliance requirements.
• Design and implement automated onboarding pipelines using Git-based configuration management, Ansible playbooks, and CI/CD workflows.
• Establish and enforce standardized tagging conventions, naming standards, and data organization principles across all onboarded applications.
• Collaborate with Business Analysts to translate requirements into technical specifications; support requirements clarification and feasibility assessment.
• Work alongside Splunk Data Admins to execute onboarding at scale; establish code review and peer collaboration practices.
• Provide consultation to Splunk users and stakeholder teams on best practices, use cases, and guidance.
• Deliver training and knowledge-sharing sessions to the Enterprise Monitoring Team and partner IT teams on standardized onboarding procedures and platform capabilities.
• Integrate Splunk with complementary monitoring platforms (Dynatrace, SolarWinds) to ensure cohesive observability workflows.
• Serve as primary technical point of contact for complex Splunk platform issues; support incident response as needed.
• Monitor Splunk platform health and performance; proactively identify and resolve bottlenecks, optimization opportunities, and infrastructure constraints.
• Correlate and reconcile disparate events and data sources from multiple monitoring platforms for consistent, reliable alerting and reporting.
• Troubleshoot and resolve complex data integration challenges; identify data quality issues, reconciliation gaps, and root causes.
• Document technical architecture, configuration decisions, onboarding procedures, and lessons learned.
• Participate in ongoing optimization and performance tuning as volume and complexity increase.

Qualifications

• Advanced Splunk Enterprise and Splunk Cloud administration.
• Strong knowledge of data models, data model accelerations, and knowledge objects.
• Deep understanding of Common Information Model (CIM) and data normalization principles.
• Experience with advanced search optimization, lookup tables, and automated lookups.
• Proficiency with Splunk Enterprise Security (ES) platform and SIEM use cases.
• Knowledge of Splunk Cloud-specific features, limitations, and best practices.
• Understanding of Splunk licensing, data ingestion pipelines, and performance tuning.
• Hands‑on experience designing and implementing data ingestion pipelines.
• Expertise in log parsing, data transformation, and field extraction.
• Strong proficiency with Git version control and collaborative development workflows.
• Hands‑on experience with Ansible for infrastructure automation and configuration management.
• Experience with CI/CD pipelines and automated deployment processes.
• Scripting and automation using Python, Bash, or similar languages.
• Understanding of SIEM platforms and security event management workflows.
• Knowledge of common security use cases (authentication, access control, threat detection, incident response).
• Familiarity with compliance frameworks (SOX, PCI‑DSS, HIPAA) and audit trail requirements.
• Desired knowledge of complementary observability platforms (Dynatrace, SolarWinds, Prometheus, Elastic).
• Minimum 3+ years of hands‑on Splunk Administration and implementation experience.
• Minimum 10+ years of infrastructure, platform engineering, systems administration, or related experience.
• Splunk Certified Admin (SCA), Splunk Certified Power User (SCPU), and Splunk ES certification or coursework completed required; additional certifications preferred.
• Excellent communication skills, positive customer‑focused interpersonal skills, collaboration, ownership, and accountability.
• Financial Services/Banking experience, especially in Large Financial Institutions or complex environments preferred.
• BE or MCA degree in computer science or related field.

Relationships & Collaboration

Reports to: Associate Director; Partners: Cross‑functional teams across geographies (US team).

Accessibility Needs

We are committed to providing an inclusive and accessible hiring process. If you require accommodations at any stage (application, interviews, onboarding) please let us know so we can work with you to ensure a seamless experience.

Equal Employment Opportunity

FC Global Services India LLP (First Citizens India) is an Equal Employment Opportunity Employer. We foster an inclusive and accessible environment and prohibit discrimination on gender, religion, caste, disability, sexual orientation, economic status or other protected characteristics. Our EEO policy ensures fairness throughout the employee lifecycle.