Splunk Engineer

JUARA IT SOLUTIONS; Chennai District; On-site; INR 900,000 - 1,800,000; Full time

Benefits offered by this job

Splunk certification support

Job summary

JUARA IT SOLUTIONS is seeking a skilled Splunk Engineer to design, implement, administer, and optimize enterprise Splunk environments in Chennai. The ideal candidate will have hands-on experience with Splunk Enterprise, ES, log management, SIEM, security monitoring, and automation.

The role involves building scalable logging solutions, developing detection use cases, and supporting SOC initiatives. Immediate joiners or up to 15 days notice.

Qualifications

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related field.
• 4–8 years of experience in Splunk Administration, SIEM Engineering, or Security Operations.
• Strong hands-on experience with Splunk Enterprise and Splunk Enterprise Security (ES).
• Experience onboarding diverse log sources and developing correlation rules.
• Strong understanding of SIEM architecture, security monitoring, and incident response.
• Knowledge of Windows, Linux, networking, cloud platforms, and cybersecurity fundamentals.
• Scripting (PowerShell or Python) for automation.
• Excellent analytical, troubleshooting, and problem-solving skills.
• Strong communication and documentation skills.

Responsibilities

• Design, deploy, configure, and administer Splunk Enterprise and Splunk Enterprise Security (ES).
• Install and maintain Splunk components, including Indexers, Search Heads, Forwarders, Deployment Servers, and Cluster Managers.
• Develop and optimize Splunk dashboards, reports, alerts, and visualizations.
• Create and maintain SPL queries, correlation searches, and detection rules.
• Integrate log sources from Windows, Linux, cloud platforms, firewalls, databases, applications, and network devices.
• Configure and manage data ingestion, parsing, indexing, retention, and storage optimization.
• Monitor the health, performance, and scalability of Splunk infrastructure.
• Support security monitoring, threat detection, incident investigation, and forensic analysis.
• Integrate Splunk with SOAR platforms, threat intelligence feeds, and third‑party security tools.
• Collaborate with SOC analysts, security engineers, and infrastructure teams to enhance detection capabilities.
• Troubleshoot ingestion issues, performance bottlenecks, and platform‑related problems.
• Perform upgrades, patching, backup, disaster recovery, and capacity planning.
• Create technical documentation, operational runbooks, and knowledge base articles.

Skills

Splunk Enterprise

Splunk Enterprise Security (ES)

Splunk SPL

SIEM Administration

Log Management

Security Monitoring

Correlation Searches

Dashboards & Reporting

Universal Forwarders

Heavy Forwarders

Indexers & Search Heads

Deployment Server

Cluster Management

Windows Server Administration

Linux Administration

Syslog

REST APIs

PowerShell

Python

TCP/IP Networking

Education

Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related field.

Tools

Splunk SOAR (Phantom)

Splunk ITSI

Splunk UBA (User Behavior Analytics)

Microsoft Sentinel

Microsoft Defender XDR

CrowdStrike Falcon

Palo Alto Networks

QRadar

ArcSight

Elastic Stack (ELK)

AWS CloudWatch

Azure Monitor

Kubernetes

Docker

ServiceNow Integration

MITRE ATT&CK Framework

Job description

Job Title: Splunk Engineer
Location: Chennai
Experience: 4–8 Years
Employment Type: Full-Time
Notice Period: Immediate Joiners or Up to 15 Days

About the Role

We are looking for a highly skilled Splunk Engineer to design, implement, administer, and optimize enterprise Splunk environments. The ideal candidate will have hands‑on experience with Splunk Enterprise, Splunk Enterprise Security (ES), log management, SIEM, security monitoring, and automation. The role involves building scalable logging solutions, developing detection use cases, and supporting Security Operations Center (SOC) initiatives.

Key Responsibilities

• Design, deploy, configure, and administer Splunk Enterprise and Splunk Enterprise Security (ES).
• Install and maintain Splunk components, including Indexers, Search Heads, Forwarders, Deployment Servers, and Cluster Managers.
• Develop and optimize Splunk dashboards, reports, alerts, and visualizations.
• Create and maintain SPL (Search Processing Language) queries, correlation searches, and detection rules.
• Integrate log sources from Windows, Linux, cloud platforms, firewalls, databases, applications, and network devices.
• Configure and manage data ingestion, parsing, indexing, retention, and storage optimization.
• Monitor the health, performance, and scalability of Splunk infrastructure.
• Support security monitoring, threat detection, incident investigation, and forensic analysis.
• Integrate Splunk with SOAR platforms, threat intelligence feeds, and third‑party security tools.
• Collaborate with SOC analysts, security engineers, and infrastructure teams to enhance detection capabilities.
• Troubleshoot ingestion issues, performance bottlenecks, and platform‑related problems.
• Perform upgrades, patching, backup, disaster recovery, and capacity planning.
• Create technical documentation, operational runbooks, and knowledge base articles.

Technical Skills

Mandatory Skills

• Splunk Enterprise
• Splunk Enterprise Security (ES)
• Splunk Search Processing Language (SPL)
• SIEM Administration
• Log Management
• Security Monitoring
• Correlation Searches
• Dashboards & Reporting
• Universal Forwarders
• Heavy Forwarders
• Indexers & Search Heads
• Deployment Server
• Cluster Management
• Windows Server Administration
• Linux Administration
• Syslog
• REST APIs
• PowerShell
• Python
• TCP/IP Networking

Good to Have

• Splunk SOAR (Phantom)
• Splunk ITSI
• Splunk UBA (User Behavior Analytics)
• Microsoft Sentinel
• Microsoft Defender XDR
• CrowdStrike Falcon
• Palo Alto Networks
• QRadar
• ArcSight
• Elastic Stack (ELK)
• AWS CloudWatch
• Azure Monitor
• Kubernetes
• Docker
• ServiceNow Integration
• MITRE ATT&CK Framework

Required Qualifications

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related field.
• 4–8 years of experience in Splunk Administration, SIEM Engineering, or Security Operations.
• Strong hands‑on experience with Splunk Enterprise and Splunk Enterprise Security (ES).
• Experience onboarding diverse log sources and developing correlation rules.
• Strong understanding of SIEM architecture, security monitoring, and incident response.
• Knowledge of Windows, Linux, networking, cloud platforms, and cybersecurity fundamentals.
• Experience with scripting (PowerShell or Python) for automation.
• Excellent analytical, troubleshooting, and problem‑solving skills.
• Strong communication and documentation skills.

Preferred Certifications

• Splunk Core Certified Power User
• Splunk Enterprise Certified Admin
• Splunk Enterprise Certified Architect
• Splunk Certified Cybersecurity Defense Analyst
• Microsoft Certified: Security Operations Analyst Associate (SC-200)
• Microsoft Certified: Azure Security Engineer Associate (AZ-500)
• CompTIA CySA+
• Certified Information Systems Security Professional (CISSP) (Preferred)
• GIAC Certified Incident Handler (GCIH) (Preferred)

Soft Skills

• Strong analytical and troubleshooting capabilities.
• Excellent communication and presentation skills.
• Ability to work independently and collaboratively in a team environment.
• Strong documentation and reporting skills.
• Ability to manage multiple priorities in a fast‑paced environment.
• Passion for cybersecurity and continuous learning.