Splunk Performance & Content Engineer

241 Unisys India (Private) LTD-UGS Bangalore; Bengaluru; On-site; INR 4,000,000 - 6,400,000; Full time

Job summary

Unisys is seeking a seasoned Splunk specialist to optimize search performance across 1,117 scheduled searches and tune data models, summaries, and CIM extractions. You will work with SOC, SRE, and app teams to drive content quality, dashboards, alerts, and detection rules for security and IT operations.

Responsibilities include data onboarding, ITSI KPI tuning, and CI/CD content lifecycle. Strong English, PK overlap with ACSC times, and Splunk certification are preferred.

Qualifications

• 8+ years of relevant experience in Splunk roles.
• Expertise in Advanced SPL, data models, accelerated searches and summary indexing.
• Experience with ITSI services, KPIs and episodes.
• Ability to collaborate with ACSC App/Dev and other teams.
• Fluent written and spoken English; comfortable with Pacific Time overlap.
• Preferred Splunk Certified Power User, Admin or Architect.
• Experience with Splunk Enterprise Security, ITSI, or Observability Cloud.
• Knowledge of MITRE ATT&CK and detection engineering.

Responsibilities

• Optimize search performance across the platform and tuning SPL.
• Remediate data-quality issues: parsing, sourcetype, index and volume.
• Monitor health and trends; report findings in monthly reports.
• Tune ITSI KPIs and episodes during ACSC business hours.
• Attend stand-ups, plan and retrospective sessions; hand over work as needed.
• Develop CIM data models, field extractions, lookups, and tags.
• Package content into apps and manage via version control and CI/CD.
• Map detections to MITRE ATT&CK and reduce false positives.
• Collaborate with SOC, SRE and application teams for requirements.

Skills

Advanced SPL

Data models

Summary indexing

ITSI KPIs

Python scripting

MITRE ATT&CK

SPL performance tuning

Content creation

Education

BA/BS degree

Tools

Splunk Enterprise Security

ITSI

Dashboard Studio

Splunk SDK

REST APIs

OpenTelemetry

Splunk Observability Cloud

Job description

What success looks like in this role:

Optimize search performance: SPL tuning, data models and summary indexing across the 1,117 scheduled searches. Tune Splunk and application settings for performance, scalability and reliability, in line with the RACI split with ACSC App/Dev. Remediate data-quality issues: parsing, sourcetype, index and volume problems. Monitor system health and search performance trends; report findings in the monthly service report. Tune ITSI KPIs and episodes during ACSC business hours. Work down the backlog in the agreed priority order, and report weekly burn-down during transition. Maintain knowledge articles and runbooks for search and content work. Attend the daily stand-up (09:15 PT) and the biweekly planning and retrospective sessions; represent Shift B at ACSC ceremonies. Receive and hand over work in progress during the 05:00-06:00 PT warm handover. Content Design and maintain dashboards, reports, alerts, correlation searches, and detection rules for security, IT operations, and application monitoring. Develop and maintain CIM-compliant data models, field extractions, lookups, event types, and tags. Package content into apps and manage it through version control and CI/CD (content lifecycle, testing, release). Map detections to frameworks such as MITRE ATT&CK, and reduce false positives through regular content tuning. Work with SOC, SRE, and application teams to gather requirements and turn them into actionable content. Performance Analyze and optimize SPL, including slow searches, expensive dashboards, and inefficient scheduled searches. Tune data model acceleration, summary indexing, report acceleration, and search scheduling to reduce load. Monitor platform performance with the Monitoring Console and internal logs (search concurrency, skipped searches, indexing latency, queue blocking, resource usage). Optimize ingestion through sourcetype and props/transforms tuning, event filtering, and index design. Establish search and content standards, review peer content, and educate users on efficient SPL. Report on content quality, search performance, and license/storage trends, and recommend capacity improvements.

You will be successful in this role if you have:

• BA/BS degree and 8+ years’ relevant experience OR equivalent combination of education and experience.
• Over 7 years of experience on Advanced SPL, including data models, accelerated searches and summary indexing.
• Search and scheduler performance analysis: skew, concurrency, search quotas and resource use.
• Data onboarding and normalization: props, transforms, CIM mapping.
• Experience tuning ITSI services, KPIs and episodes.
• Ability to work with application and dashboard owners without owning dashboard design (ACSC App/Dev remains responsible).
• Clear written and spoken English; comfortable overlapping the ACSC working day (Pacific Time).
• Preferred Splunk Certified Power User, Admin or Architect.
• Splunk Observability Cloud and OpenTelemetry exposure.
• Scripting for automation (Python or Bash).
• Experience working a backlog in a Kanban or sprint model.
• Experience with Splunk Enterprise Security, ITSI, or Observability Cloud.
• Knowledge of detection engineering practices and MITRE ATT&CK.
• Experience with Dashboard Studio, REST APIs, and the Splunk SDK.
• #LI-SN1

Unisys is proud to be an equal opportunity employer that considers all qualified applicants without regard to age, blood type, caste, citizenship, color, disability, family medical history, family status, ethnicity, gender, gender expression, gender identity, genetic information, marital status, national origin, parental status, pregnancy, race, religion, sex, sexual orientation, transgender status, veteran status or any other category protected by law. Local employment practices and rights may vary by jurisdiction and are subject to applicable local laws. This commitment includes our efforts to provide for all those who seek to express interest in employment the opportunity to participate without barriers. If you are a US job seeker unable to review the job opportunities herein, or cannot otherwise complete your expression of interest, without additional assistance and would like to discuss a request for reasonable accommodation, please contact our Global Recruiting organization at [e-mail]. US job seekers can find more information about Unisys’ EEO commitment here.

Unisys is a global technology solutions company that powers breakthroughs for the world’s leading organizations. Our solutions – cloud, AI, digital workplace, logistics and enterprise computing – help our clients challenge the status quo and unlock their full potential. To learn how we have been helping clients push what’s possible for more than 150 years, visit unisys.com and follow us on LinkedIn. https://www.unisys.com/unisys-legal/recruiting Notice for U.S. Applicants: Unisys is an Equal Opportunity Employer – Minorities/ Females/ Veterans/ Individuals with Disabilities/ Sexual Orientation/ Gender Identity