SIEM Architect & Engineer (CISO)

Avaloq AG; Manila; On-site; PHP 800,000 - 1,200,000; Full time

Job summary

Avaloq AG seeks an experienced Splunk Engineer to design, implement, and run the Splunk infrastructure in our Manila operations. You will deploy indexer and search head clusters, optimize existing deployments, and monitor platform health to ensure proactive issue resolution.

The role involves integrating data sources, security tools, and cloud services, plus building add-ons and apps for large-scale forwarder deployments.

Qualifications

• Experience designing and managing Splunk infrastructure.
• Experience deploying Splunk indexer and search head clusters.
• Ability to optimize existing Splunk deployments and monitor platform health.

Responsibilities

• Design, implement, and manage the Splunk infrastructure.
• Deploy and manage Splunk indexer clusters and search head clusters.
• Perform optimization of existing clustered Splunk deployments.
• Monitor operations of Splunk platform to enable proactive issue identification, response, and resolution.
• Integrate Splunk with legacy data sources, security tools, and Cloud providers.
• Build Splunk Technology Add-ons and apps for deployment across forwarders.
• Develop scripts in Python, Bash, PowerShell, and VBScript.
• Interact with REST API endpoints and SQL databases.
• Onboard data sources, create indexes, data models, and CIM mappings.
• Manage knowledge objects, RBAC, and alerts in Splunk.

Skills

Splunk administration

Splunk clustering

Security operations

Scripting (Python)

Data onboarding

Tools

Python

Bash

PowerShell

VBScript

Job description

• Design, implement, and manage the Splunk infrastructure.


• Deploy and manage Splunk indexer clusters and search head clusters.


• Performing optimization of existing clustered Splunk deployments.


• Monitor operations of Splunk platform to enable proactive issue identification, response, and resolution.


• Integrate Splunk with a wide variety of legacy data sources, industry leading commercial security tools and Cloud Service provider facilities.
  
  
  
  • Build Splunk Technology Add-ons.
  
  
  • Build custom script in the following languages (Python, Bash, PowerShell, VBscripts).
  
  
  • Build Splunk apps to be deployed on thousands of Splunk Universal Forwarders.
  
  
  • Interact with REST API endpoints.
  
  
  • Interact with RBDMS in SQL.
  
  
  
  


• Effectively and efficiently onboard data sources, create indexes and data model, create CIM compliant data mapping, establish health monitoring and KPIs.


• Manage Splunk knowledge objects (Apps, Dashboards, Saved Searches, Scheduled Searches, Alerts. etc..)


• Manage Splunk Role Based Access Control.


• Design and implement Correlation Searches in Splunk Enterprise Security.


• Maintain and extend correlation between Asset&Identity and Splunk Enterprise Security framework.


• Onboard Threat Intelligence feeds and correlate with data.


• Assist Security Analysts providing them consultancy to leverage the Splunk environment.


• Drive the operational model transformation of SecOps.


• Identify technology gaps, security gaps, develop solutions and make recommendations for continuous improvement.