Splunk Operations Lead

Visible Stars, Inc.; Riyadh; On-site; SAR 223,200 - 334,800; Full time

Job summary

A technology services company in Saudi Arabia is seeking a highly skilled Splunk Expert to manage and optimize their Splunk infrastructure. Responsibilities include leading daily operations, overseeing scaling advisement, and ensuring compliance with SLA standards. The ideal candidate will have a minimum of 7–10 years’ experience with Splunk deployments and a track record of developing detection rules. This role presents an exciting opportunity to enhance the organization's security posture and operational efficiency.

Qualifications

• At least 7–10 years of experience in Splunk enterprise deployments.
• Experience in developing and tuning detection rules for security monitoring.
• Familiarity with regulatory frameworks such as PCI DSS.

Responsibilities

• Lead daily Splunk operations and ensure SLA adherence.
• Oversee scaling advisement and expansion readiness.
• Act as the main point of contact for internal teams.

Skills

Splunk infrastructure monitoring

Cluster management

Splunk upgrades and patch management

License usage optimization

Incident response support

Developing detection rules and alerts

Compliance and regulatory understanding

Tools

Splunk

Job description

Overview

Expertise: Splunk Enterprise Certified Architect, minimum 7–10 years in Splunk enterprise deployments.

Responsibilities: Lead daily Splunk operations and ensure SLA adherence. Perform infrastructure management and health checks. Oversee scaling advisement and expansion readiness. Act as the main point of contact for the Bank’s internal teams. Organized support for major incident response efforts.

Job qualifications

• Daily health checks and monitoring of Splunk infrastructure performance (indexers, search heads, deployment servers, cluster masters, etc.).
• Indexer and search head cluster management (including failover and scaling).
• Splunk upgrades, patch management, and hotfix applications.
• License usage monitoring and optimization.
• Onboarding of new data sources, including parsing, field extractions, and CIM (Common Information Model) compliance.
• Use Case Lifecycle Management (Development, Tuning, Optimization):
• Work with stakeholders to identify security monitoring use cases.
• Develop new detection rules, correlation searches, dashboards, and alerts.
• Fine-tune existing use cases to reduce false positives and improve detection accuracy.
• Align all use cases with threat intelligence (MITRE ATT&CK, local TTPs, sectoral threats).
• Map use cases to regulatory frameworks (SAMA CSF, NCA ECC/CCC, PCI DSS).
• Develop use cases based on frameworks such as MITRE ATT&CK, OWASP.
• Map Use-cases for InfoSec tools, security technologies & cover additional InfoSec tool Splunk integration.
• Creation and maintenance of dashboards (supporting threat hunting, data sources coverage, critical assets coverage and endpoint security control coverage), alerts, reports, and correlation searches.
• Splunk apps and add-on installation, application onboarding, configuration, and lifecycle management.
• Splunk optimization by troubleshooting ingestion delays, parsing errors, and search performance issues.
• Storage capacity management and archiving strategies.
• Implementing and maintaining Role-Based Access Control (RBAC).
• Support for compliance, audit, and regulatory reporting requirements.
• Incident response support by ensuring Splunk visibility for detection and investigation.
• Documentation of processes, configurations, and knowledge transfer.
• Continuous monitoring for regulatory compliance.

Specialized Reviews & Advisory Services

1. The Bank requires to utilize Splunk services to perform assessments and optimizations, specifically:
2. Post-Implementation Review
3. Data Model Review
4. Data Source Review
5. Security Integrations & Monitoring Review
6. Scaling Advisement & Expansion Readiness Assessment
7. Advanced use case management
8. Quarterly review of SIEM Architecture & Security Posture
9. Evaluation of existing detection rules
10. Bi-Annual review for planning of SIEM evolution and enhancement