Splunk Performance & Content Engineer

TigerHire; Bengaluru; On-site; INR 3,000,000 - 5,000,000; Full time

Job summary

Unisys is seeking a Senior Splunk Engineer in Bengaluru to optimize search performance, design data models, and implement summary indexing across large-scale searches. You will tune SPL, ensure reliability, and align content with MITRE ATT&CK frameworks, collaborating with SOC/SRE teams.

Responsibilities include CIM data models, field extractions, dashboards, and content packaging with CI/CD. You will manage backlogs in Kanban, monitor platform health, and contribute to quarterly release

Qualifications

• BA/BS degree and 8+ years’ relevant experience OR equivalent combination of education and experience.
• Over 7 years of experience on Advanced SPL, including data models, accelerated searches and summary indexing.
• Experience tuning ITSI services, KPIs and episodes.
• Knowledge of detection engineering practices and MITRE ATT&CK.

Responsibilities

• Tune SPL and data models for performance, scalability and reliability.
• Develop and maintain CIM-compliant data models, field extractions, lookups, event types, and tags.
• Map detections to MITRE ATT&CK and reduce false positives through content tuning.
• Package content into apps and manage it through version control and CI/CD.
• Work with SOC, SRE, and application teams to gather requirements and turn them into content.

Skills

Advanced SPL

Data models

Summary indexing

Content tuning

SPL performance tuning

Backlog Kanban

Python / Bash scripting

Collaboration with SOC/SRE

Education

BA/BS degree

Tools

Splunk

Splunk Enterprise Security

ITSI

Dashboard Studio

REST APIs

Splunk SDK

Job description

Optimize search performance: SPL tuning, data models and summary indexing across the 1,117 scheduled searches.

Tune Splunk and application settings for performance, scalability and reliability, in line with the RACI split with ACSC App/Dev.

Remediate data-quality issues: parsing, sourcetype, index and volume problems.

Monitor system health and search performance trends; report findings in the monthly service report.

Tune ITSI KPIs and episodes during ACSC business hours.

Work down the backlog in the agreed priority order, and report weekly burn-down during transition.

Maintain knowledge articles and runbooks for search and content work.

Attend the daily stand-up (09:15 PT) and the biweekly planning and retrospective sessions; represent Shift B at ACSC ceremonies.

Receive and hand over work in progress during the 05:00-06:00 PT warm handover.

Content Design and maintain dashboards, reports, alerts, correlation searches, and detection rules for security, IT operations, and application monitoring.

Develop and maintain CIM-compliant data models, field extractions, lookups, event types, and tags.

Package content into apps and manage it through version control and CI/CD (content lifecycle, testing, release).

Map detections to frameworks such as MITRE ATT&CK, and reduce false positives through regular content tuning.

Work with SOC, SRE, and application teams to gather requirements and turn them into actionable content.

Performance Analyze and optimize SPL, including slow searches, expensive dashboards, and inefficient scheduled searches.

Tune data model acceleration, summary indexing, report acceleration, and search scheduling to reduce load.

Monitor platform performance with the Monitoring Console and internal logs (search concurrency, skipped searches, indexing latency, queue blocking, resource usage).

Optimize ingestion through sourcetype and props/transforms tuning, event filtering, and index design.

Establish search and content standards, review peer content, and educate users on efficient SPL.

Report on content quality, search performance, and license/storage trends, and recommend capacity improvements.

You will be successful in this role if you have

BA/BS degree and 8+ years’ relevant experience OR equivalent combination of education and experience.

Over 7 years of experience on Advanced SPL, including data models, accelerated searches and summary indexing.

Search and scheduler performance analysis: skew, concurrency, search quotas and resource use.

Data onboarding and normalization: props, transforms, CIM mapping.

Experience tuning ITSI services, KPIs and episodes.

Ability to work with application and dashboard owners without owning dashboard design (ACSC App/Dev remains responsible).

Clear written and spoken English; comfortable overlapping the ACSC working day (Pacific Time).

Preferred Splunk Certified Power User, Admin or Architect.

Splunk Observability Cloud and OpenTelemetry exposure.

Scripting for automation (Python or Bash).

Experience working a backlog in a Kanban or sprint model.

Experience with Splunk Enterprise Security, ITSI, or Observability Cloud.

Knowledge of detection engineering practices and MITRE ATT&CK.

Experience with Dashboard Studio, REST APIs, and the Splunk SDK.

#LI-SN1 Unisys is proud to be an equal opportunity employer that considers all qualified applicants without regard to age, blood type, caste, citizenship, color, disability, family medical history, family status, ethnicity, gender, gender expression, gender identity, genetic information, marital status, national origin, parental status, pregnancy, race, religion, sex, sexual orientation, transgender status, veteran status or any other category protected by law.

Local employment practices and rights may vary by jurisdiction and are subject to applicable local laws. This commitment includes our efforts to provide for all those who seek to express interest in employment the opportunity to participate without barriers.

If you are a US job seeker unable to review the job opportunities herein, or cannot otherwise complete your expression of interest, without additional assistance and would like to discuss a request for reasonable accommodation, please contact our Global Recruiting organization at [e-mail]. US job seekers can find more information about Unisys’ EEO commitment here.