Splunk Engineer

Flairdeck; Bengaluru; On-site; INR 2,500,000 - 4,200,000; Full time

Job summary

Flairdeck in Bengaluru, India seeks an experienced Senior Splunk Administrator to oversee deployment, configuration, optimization, and ongoing management of the Splunk environment, including SIEM use case development and automation support for SOC operations.

The role involves onboarding logs from diverse sources, developing correlation rules, dashboards, and SPL queries, while maintaining platform health, RBAC, data retention, and DR readiness.

Qualifications

• Senior Splunk Administrator with deployment and ongoing management experience.
• Experience in SIEM use case development and automation support for SOC operations.
• Strong ability to optimize Splunk performance and manage RBAC and data retention policies.

Responsibilities

• Install, configure, and manage Splunk Enterprise / Splunk ES (Standalone, Distributed, Clustered).
• Onboard logs from servers, devices, security tools, endpoints and cloud platforms.
• Develop use cases, correlations, and fine-tune MITRE ATT&CK aligned rules.
• Create dashboards, alerts, reports, and SPL queries.
• Support SOAR playbooks and automation for incident response.

Tools

Splunk Enterprise

Splunk ES

MITRE ATT&CK

Job description

Job Summary

Role Summary: We are seeking an experienced Senior Splunk Administrator responsible for deployment, configuration, optimization, and ongoing management of the Splunk environment, including SIEM use case development and automation support for SOC operations.

Responsibilities

• Install, configure, and manage Splunk Enterprise / Splunk ES (Standalone, Distributed, Clustered).
• Configure and maintain Indexers, Search Heads, Forwarders, Deployment Server, Cluster Master.
• Onboard and integrate logs from servers, network devices, security tools, endpoints, and cloud platforms.
• Perform use case creation, correlation rule development, and fine-tuning aligned with MITRE ATTCK framework.
• Optimize detection logic to reduce false positives and improve alert quality.
• Develop and maintain dashboards, alerts, reports, and advanced SPL queries.
• Support SOAR playbook development and automation workflows for incident response (phishing, malware, ransomware, etc.).
• Monitor Splunk platform health, performance tuning, EPS optimization, and storage management.
• Troubleshoot ingestion, parsing (props.conf, transforms.conf), and search performance issues.
• Implement RBAC, data retention policies, and security hardening.
• Support version upgrades, patching, backup, and DR setup.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.