Hybrid Splunk Architect - SIEM & Incident Response Lead

TEKsystems; United States; Hybrid; USD 80,000 - 114,000; Full time

Benefits offered by this job

Medical, dental & vision

401(k) Retirement Plan

Life Insurance

PTO / Vacation

HSA Health Spending Account

Job summary

TEKsystems seeks a Splunk Platform Operations lead to own end-to-end production support for a highly distributed Splunk Enterprise and Splunk Cloud environment.

You will manage clusters, ensure availability and performance, and lead incident response and root-cause analysis while working with security teams on SIEM enablement and data ingestion. This hybrid role is based in Richmond, VA.

Qualifications

• Production-owner mindset and strong Splunk architecture expertise.
• Ability to lead troubleshooting during critical platform and security incidents.
• Experience with highly distributed Splunk Enterprise and Splunk Cloud environments.

Responsibilities

• Own end-to-end production support for a highly distributed Splunk environment.
• Manage and support search head clusters, indexer clusters, deployers, deployment servers, heavy forwarders, and universal forwarders.
• Ensure platform availability, resiliency, scalability, and performance.
• Lead incident response, troubleshooting, root cause analysis, and service restoration activities.
• Identify and remediate performance bottlenecks, capacity constraints, and operational risks.
• Perform system tuning and proactive health measures.

Skills

Splunk

Cribl

Tools

Splunk Enterprise

Splunk Cloud

Cribl

Job description

TEKsystems seeks a Splunk Platform Operations lead to own end-to-end production support for a highly distributed Splunk Enterprise and Splunk Cloud environment.

You will manage clusters, ensure availability and performance, and lead incident response and root-cause analysis while working with security teams on SIEM enablement and data ingestion. This hybrid role is based in Richmond, VA.