Senior Splunk Engineer

Tamkeen Technologies; Saudi Arabia; On-site; SAR 120,000 - 180,000; Full time

Job summary

A technology services company in Saudi Arabia is looking for a Senior Splunk Engineer to enhance analytics and monitoring within IT infrastructure. The ideal candidate will manage Splunk infrastructure across multiple clients, ensuring optimal performance and data onboarding processes. A strong background in Splunk with a degree in a relevant field is required. Competitive compensation and growth opportunities are provided.

Qualifications

• 3–5 years of experience as a Splunk Administrator in an MSSP environment.
• Hands-on experience with Splunk architecture components.
• Strong knowledge of data onboarding processes and performance tuning.

Responsibilities

• Manage Splunk infrastructure across multiple clients.
• Design data onboarding processes and manage indexers.
• Troubleshoot Splunk performance and data ingestion issues.

Skills

Splunk Enterprise

SPL

Linux/Unix scripting

Data onboarding

Threat detection

Education

Bachelor’s degree in Information Security or Computer Science

Tools

Splunk Enterprise Security

SOAR integrations

Job description

Overview

Tamkeen Technologies is looking for a talented Senior Splunk Engineer to enhance our analytics and monitoring capabilities across the organization's IT infrastructure. In this role, you will be responsible for the design, development, and maintenance of Splunk-based solutions to collect, analyze, and visualize data for security and operational insights. You will work closely with various teams to implement best practices in data ingestion, dashboard creation, and alert configuration to support organizational goals. If you have a strong background in Splunk and a keen interest in data analytics, we encourage you to apply and join our innovative team.

Responsibilities

• Administer and manage Splunk infrastructure across multiple clients in a multi-tenant MSSP environment.
• Design and implement data onboarding processes including parsing, indexing, and field extractions.
• Manage indexers, search heads, forwarders, and heavy forwarders for optimal performance.
• Troubleshoot and resolve Splunk performance, search latency, and data ingestion issues.
• Develop and optimize SPL queries, dashboards, alerts, and reports.
• Ensure high availability, performance, and scalability of the Splunk platform.
• Maintain forwarders, heavy indexers, search heads, and deployment servers.
• Perform troubleshooting and root cause analysis for log ingestion and performance issues.
• Support client onboarding, use case development, and data source integration.
• Collaborate with SOC analysts, threat hunters, and client security teams to enhance visibility and detection.
• Maintain compliance with internal security policies and relevant regulatory frameworks.
• Implement role-based access control (RBAC), data retention policies, and compliance configurations.
• Work closely with MSSP clients to understand their security monitoring requirements.
• Provide Splunk expertise, troubleshooting, and best practices to internal and external stakeholders.
• Produce documentation for architecture, configurations, processes, and operational runbooks.

Qualifications

• Bachelor’s degree in Information Security, Computer Science, or a related technical field.
• Minimum 3–5 years of experience as a Splunk Administrator, preferably in an MSSP or multi-client environment.
• Deep hands‑on experience with Splunk Enterprise, Splunk Enterprise Security (ES), and Splunk architecture components.
• Strong knowledge of SPL, data onboarding (parsing, field extractions, props/transforms), and performance tuning.
• Experience with Splunk integrations, including threat intelligence feeds, SOAR, and third‑party tools.
• Familiarity with Linux/Unix systems and scripting (e.g., Python, Bash, PowerShell).
• Strong understanding of SIEM use cases, threat detection, and log analysis.
• Splunk certifications such as Splunk Certified Admin, Power User, or Architect are highly preferred.
• Splunk certifications (Splunk Certified Admin, Splunk ES Certified, Splunk Architect).