Splunk Architect

NTT DATA, Inc.; Bengaluru; On-site; INR 3,500,000 - 5,200,000; Full time

Job summary

NTT DATA, Inc. invites an experienced L4 Active Splunk Enterprise Certified Architect to lead SIEM assessments and optimize the client’s Splunk environment.

The role requires documenting current state, reviewing architecture and data flows, and advising on improvements while guiding a team of consultants in a client-focused delivery. The successful candidate will drive governance, data management, and use-case development, ensuring CIM-compliant log sources and effective security controls across

Qualifications

• 7+ years hands-on experience with Splunk ES.
• Proven experience in managing and leading SIEM assessments with a focus on Splunk.
• Strong governance, data management, and use case development understanding.
• Excellent communication and leadership skills to guide a team of consultants.

Responsibilities

• Lead assessment of the client's SIEM platform and document its current state.
• Review SIEM deployment docs including architecture diagrams and data flows.
• Track and report on information security controls and suggest improvements.
• Create documentation for ongoing security support and maintenance of Security Platforms.
• Support Security Assurance by providing operational requirements for projects.
• Assist client to make log sources CIM compliant.
• Evaluate system architecture, data management, use cases, and governance as per SIEM Assessment Framework.

Skills

Splunk ES

SIEM assessments

Leadership

Documentation

Communication

Architecture review

Job description

We’re looking for a L4 Active Splunk Enterprise Certified Architect

Key Skills:

• Lead the assessment of the client's SIEM platform, ensuring thorough evaluation and documentation of its current state.
• Obtain and review all relevant documentation related to the SIEM deployment, including architecture diagrams, data flow diagrams, process flows, and procedures.
• Track and report on information security controls and their effectiveness, making recommendations for improvements.
• Contribute to creating documentation required for ongoing security support and maintenance of Security Platforms
• Support the Security Assurance function by providing operational requirements for projects.
• Assist client to make log sources CIM compliant.
• Analyze the SIEM platform across focus areas following SIEM Assessment Framework, which includes:
• System Architecture: Evaluate SIEM’s system components (forwarders, search heads, indexers, etc.), assess non-functional requirements (availability, scalability, performance, data retention, monitoring), review the health monitoring process, and examine the current integration with the ServiceNow Security Incident Response (SIR) module.
• Data Management: Evaluate data management processes including data source onboarding and prioritization, data pipelines, log streaming, data quality and normalization, and data enrichment.
• Use Case Development: Evaluate intake, prioritization, development, and detection-as-code processes.
• Governance: Evaluate the existing governance framework, operating and interaction models, relevant policies and standards, governing committees and working groups, and training programs.

Required Skills:

• 7+ years of hands-on experience with Splunk ES.
• Proven experience in managing and leading SIEM assessments with a focus on Splunk.
• Strong understanding of SIEM system components, data management processes, use case development, and governance frameworks.
• Strong communication and leadership skills, with the ability to lead a team of consultants and interact effectively with client teams