Cribl Platform Support Engineer (L2/L3)

NTT DATA, Inc.; Frisco (TX); On-site; USD 79,000 - 137,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

401(k) with company match

Paid time off

Employee assistance program

Flexible spending or health savings

Life and AD&D insurance

Short and long term disability

Job summary

NTT DATA seeks a Cribl Application Support Engineer to join our Frisco, Texas team. You will provide L2/L3 production support for Cribl Stream, monitor platform health, and troubleshoot data-flow issues across Linux systems and network layers.

Responsibilities include configuring sources/destinations/routes/pipelines, performing deployments, incident management per ITSM, and writing Shell/Python scripts for automation.

Qualifications

• 5+ years Cribl Stream administration and monitoring.
• 5+ years Leader Nodes, Worker Nodes, Worker Groups, Sources, Destinations, Routes, Pipelines and Packs.
• 5+ years Log ingestion, routing, filtering, parsing, transformation, enrichment and troubleshooting.
• 5+ years Bash/Korn Shell scripting and operational automation.
• 5+ years Basic-to-intermediate Python scripting for support automation.
• 5+ years Log parsing with Regex/JSON and data transformations.
• 5+ years TCP/IP, DNS, ports, firewall and connectivity troubleshooting.
• 5+ years Knowledge of Splunk, Elastic, Sentinel or similar SIEM/Observability platforms.
• 5+ years Incident, Change, Problem and ITSM processes.
• Understanding of Git/version-control concepts and basic usage.

Responsibilities

• Provide L2/L3 production support/administration for the Cribl platform, primarily Cribl Stream.
• Monitor Cribl Leader Nodes, Worker Nodes, Worker Groups, Sources, Destinations, Routes, Pipelines and overall platform health.
• Troubleshoot Cribl application/service failures, data-flow issues, and connectivity problems.
• Investigate issues where logs/events are not received, delayed, dropped, incorrectly routed, or not reaching the destination.
• Configure and troubleshoot Sources, Destinations, Routes, Pipelines, Packs, and Functions.
• Perform Cribl service start/stop, configuration changes, deployments, maintenance and health checks.
• Investigate alerts and production incidents using Cribl logs, dashboards and OS logs.
• Perform RCA for recurring or critical incidents.
• Support Cribl installation, configuration, patching, upgrades and maintenance.
• Troubleshoot Linux/Unix, network, filesystem, CPU, memory, disk space and system resources.
• Troubleshoot TCP/IP, DNS, ports, firewall, certificates, SSL/TLS and connectivity issues.
• Monitor and troubleshoot data throughput, queues, backpressure and performance issues.
• Support integrations between Cribl and platforms like Splunk, Elastic, Kafka, Syslog, Sentinel, AWS, Azure and other SIEM/observability tools.
• Write and maintain Shell/Python scripts for monitoring, health checks, log analysis, reporting and automation.
• Handle incident/change/problem/service-request tickets using ITSM processes.
• Maintain SOPs, runbooks and knowledge articles.
• Participate in on-call/production support and major incident troubleshooting.
• Coordinate with infrastructure, network, security, SIEM/observability and application teams for issue resolution.
• Coordinate with Cribl/vendor support for complex product-level issues.

Skills

Cribl Stream administration

Leader/Worker architecture

Log ingestion & troubleshooting

Shell scripting

Python scripting

Regex / JSON parsing

Networking (TCP/IP, DNS)

SIEM / Observability

ITSM processes

Git / version control

Tools

Cribl Stream

Splunk

Elastic Stack

Kafka

Syslog

REST APIs / HTTP integrations

AWS/Azure logging

Git

ServiceNow

Job description

NTT DATA seeks a Cribl Application Support Engineer to join our Frisco, Texas team. You will provide L2/L3 production support for Cribl Stream, monitor platform health, and troubleshoot data-flow issues across Linux systems and network layers.

Responsibilities include configuring sources/destinations/routes/pipelines, performing deployments, incident management per ITSM, and writing Shell/Python scripts for automation.