Cyber & IT Operations Analytics Engineer

KDA Consulting; Herndon (VA); Presencial; USD 140.000 - 180.000; Jornada completa

Descripción de la vacante

KDA Consulting is seeking a hands-on Cyber & IT Operations Data / Splunk Analytics Engineer to support the Sponsor’s IT systems data modernization. You will design data quality baselines, standardize schemas (e.g., CIM), and build robust ingestion pipelines for high-velocity telemetry to enable threat analysis and IT health monitoring.

In this role, you will architect Splunk deployments, optimize SPL searches, and collaborate with cloud and platform engineers to deliver observable,

Formación

• Bachelor's degree in CS/IT/Cyber or equivalent experience.
• Hands-on experience with Splunk CIM and data normalization.
• Proven ability to architect data ingestion pipelines and telemetry standards.
• Active TS/SCI with Polygraph is required.

Responsabilidades

• Standardize, cleanse, and normalize high-velocity machine data into common schemas.
• Configure and optimize distributed Splunk infrastructure and data ingestion.
• Develop SPL queries, accelerated data models, and real-time alerts.
• Design data routing, parsing, and transformation pipelines using Splunk or NiFi.
• Build dashboards and reports translating security events to insights.
• Collaborate with platform and cloud engineers to integrate datasets.

Conocimientos

Data quality

Telemetry standards

Security analytics

Splunk optimization

Scripting & automation

Cloud security

Educación

Bachelor's degree

Herramientas

Splunk

Apache NiFi

Kafka

Python

Bash

JSON/REST APIs

Descripción del empleo

We are seeking a hands-on Cyber & IT Operations Data / Splunk Analytics Engineer to support the Sponsor’s IT systems data modernization ecosystem. In this role, you will address critical data challenges by establishing data quality baselines, schema standards, and normalization pipelines for high-velocity, disparate cyber feeds and IT operations telemetry (system performance metrics, service health, network infrastructure logs, and application events). Working within an Agile engineering environment, you will architect robust ingest pipelines, build optimized Splunk models and correlation searches, and ensure raw telemetry is transformed into standardized, high-confidence data powering both threat analysis and holistic IT operational health monitoring.

• Data Quality & Normalization: Standardize, cleanse, and normalize high-velocity machine data from disparate security tools and IT operational systems into common information schemas (e.g., Splunk CIM) to ensure data fidelity, search efficiency, and unified observability.
• Splunk Architecture & Operations: Configure, tune, monitor, and administer distributed Splunk infrastructure (Heavy Forwarders, Universal Forwarders, Indexer Clusters, Search Head Clusters) and ingest streams.
• Analytics & Search Optimization: Develop complex, performance-optimized Search Processing Language (SPL) queries, accelerated data models, event correlations, and real-time alerts supporting cyber threat detection and IT operational reliability/availability.
• Telemetry Pipeline Engineering: Design and support data routing, parsing, filtering, and transformation pipelines for logs, metrics, and traces using Splunk Forwarders, Syslog/HEC, or Apache NiFi.
• Observability & Dashboards: Build operational dashboards and reporting interfaces that translate security events and IT operational health/performance indicators into actionable insights for engineers and leadership.
• Ecosystem Integration: Collaborate with platform and cloud engineers to integrate clean, standardized cyber and IT operational datasets with downstream machine learning and automated analytics tooling.

• Splunk Administrative Expertise: Hands-on experience deploying, architecting, managing, and optimizing distributed enterprise Splunk environments, including index management, forwarder configurations, search optimization, and data model acceleration.
• Cyber & IT Operations Telemetry Standards: Proven experience with log and metric telemetry (syslog, Windows Event Logs, network flows, application logs, infrastructure metrics), field extraction (props.conf / transforms.conf), and enforcing data quality and normalization standards across high-throughput data streams.
• Data Ingestion & Pipelines: Experience ingesting, parsing, and routing streaming data utilizing Splunk native inputs, HTTP Event Collector (HEC), Apache NiFi, or Kafka.
• Scripting & Automation: Ability to write scripts in Python, Bash, or JSON/REST APIs to automate data collection, pipeline health monitoring, and data sanitization tasks.
• Infrastructure & Enclave Environment: Solid working knowledge of Linux system administration, network connectivity troubleshooting, and secure cloud environments (e.g., AWS).
• Education & Experience: Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field (or equivalent operational engineering experience).
• Must have an active TS/SCI with Polygraph Clearance.