Cyber & IT Operations Analytics Engineer

KDA Consulting Inc; Herndon (VA); On-site; USD 120,000 - 180,000; Full time

Job summary

KDA Consulting Inc. seeks a hands-on Cyber & IT Operations Data / Splunk Analytics Engineer to advance data modernization across security and IT telemetry.

You will design ingest pipelines, build Splunk models, and deliver observable dashboards for threat analysis and reliable IT operations. Responsibilities include data quality normalization to CIM standards, configuring Splunk architecture, and engineering telemetry pipelines with forwarders, HEC, NiFi, or Kafka in an Agile environment.

Qualifications

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or related field.
• Active TS/SCI with polygraph clearance is required.
• Hands-on experience with Splunk Enterprise and distributed deployments.
• Experience with CIM standardization, data normalization, and telemetry pipelines.
• Strong scripting skills (Python, Bash) for automation.
• Experience with Linux system administration and cloud environments (AWS).

Responsibilities

• Standardize, cleanse, and normalize streaming cyber and IT telemetry into CIM-compliant schemas.
• Configure and manage distributed Splunk infrastructure (Heavy Forwarders, Indexers, Search Heads).
• Develop SPL queries, accelerated data models, and real-time alerts for threat detection and IT ops health.
• Design ingestion pipelines (Splunk inputs, HEC, NiFi, Kafka) for logs, metrics, and traces.
• Build dashboards translating security events and operational health into actionable insights.
• Collaborate with platform/cloud engineers to integrate datasets for ML and analytics tooling.

Skills

Splunk analytics

Data quality

ETL pipelines

SPL queries

Dashboards

Python/ Bash

Linux administration

AWS cloud

Education

Bachelor's degree in CS/IT/Cybersecurity

Tools

Splunk

Apache NiFi

Kafka

HTTP Event Collector (HEC)

Prop.conf / transforms.conf

Job description

We are seeking a hands-on Cyber & IT Operations Data / Splunk Analytics Engineer to support the Sponsor's IT systems data modernization ecosystem. In this role, you will address critical data challenges by establishing data quality baselines, schema standards, and normalization pipelines for high-velocity, disparate cyber feeds and IT operations telemetry (system performance metrics, service health, network infrastructure logs, and application events). Working within an Agile engineering environment, you will architect robust ingest pipelines, build optimized Splunk models and correlation searches, and ensure raw telemetry is transformed into standardized, high-confidence data powering both threat analysis and holistic IT operational health monitoring.

• Data Quality & Normalization: Standardize, cleanse, and normalize high-velocity machine data from disparate security tools and IT operational systems into common information schemas (e.g., Splunk CIM) to ensure data fidelity, search efficiency, and unified observability.
• Splunk Architecture & Operations: Configure, tune, monitor, and administer distributed Splunk infrastructure (Heavy Forwarders, Universal Forwarders, Indexer Clusters, Search Head Clusters) and ingest streams.
• Analytics & Search Optimization: Develop complex, performance-optimized Search Processing Language (SPL) queries, accelerated data models, event correlations, and real-time alerts supporting cyber threat detection and IT operational reliability/availability.
• Telemetry Pipeline Engineering: Design and support data routing, parsing, filtering, and transformation pipelines for logs, metrics, and traces using Splunk Forwarders, Syslog/HEC, or Apache NiFi.
• Observability & Dashboards: Build operational dashboards and reporting interfaces that translate security events and IT operational health/performance indicators into actionable insights for engineers and leadership.
• Ecosystem Integration: Collaborate with platform and cloud engineers to integrate clean, standardized cyber and IT operational datasets with downstream machine learning and automated analytics tooling.

• Splunk Administrative Expertise: Hands-on experience deploying, architecting, managing, and optimizing distributed enterprise Splunk environments, including index management, forwarder configurations, search optimization, and data model acceleration.
• Cyber & IT Operations Telemetry Standards: Proven experience with log and metric telemetry (syslog, Windows Event Logs, network flows, application logs, infrastructure metrics), field extraction (props.conf / transforms.conf), and enforcing data quality and normalization standards across high-throughput data streams.
• Data Ingestion & Pipelines: Experience ingesting, parsing, and routing streaming data utilizing Splunk native inputs, HTTP Event Collector (HEC), Apache NiFi, or Kafka.
• Scripting & Automation: Ability to write scripts in Python, Bash, or JSON/REST APIs to automate data collection, pipeline health monitoring, and data sanitization tasks.
• Infrastructure & Enclave Environment: Solid working knowledge of Linux system administration, network connectivity troubleshooting, and secure cloud environments (e.g., AWS).
• Education & Experience: Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field (or equivalent operational engineering experience).
• Must have an active TS/SCI with Polygraph Clearance.