Principal Splunk Engineer: Large-Scale SIEM & Cloud

Koitecc Solutions; New Jersey; On-site; USD 122,000 - 200,000; Full time

Benefits offered by this job

Discretionary annual bonus

Industry-leading benefits

Paid time off

Job summary

Bank of America is seeking a Principal Splunk Engineer to lead the design, operation, and evolution of a large-scale Splunk Enterprise / Splunk Cloud deployment across security, infrastructure, and applications. The platform ingests multi-terabyte daily data volumes and is central to SOC and threat detection.

Ideal candidates have deep SPL expertise, SmartStore/Indexer Clustering experience, and strong Python/Bash scripting with automation (Ansible, Terraform).

Qualifications

• 5+ years experience administering large Splunk Enterprise or Splunk Cloud environments.
• Strong hands-on knowledge of indexer clustering, search head clustering, and SmartStore integration.
• Deep experience with security log ingestion and SIEM use cases.
• Strong SPL expertise including search optimization and data model acceleration.
• Experience with Linux systems, scripting (Python/Bash), and automation tools (Ansible, Terraform).

Responsibilities

• Architect, operate, and optimize a distributed, large-scale Splunk environment across multiple sites.
• Lead capacity planning, index design, and data retention strategies.
• Maintain high availability and DR across deployments; drive upgrades and hardening.
• Collaborate with SOC and Threat Hunting teams to ensure high-quality log ingestion.
• Establish governance with dashboards, mappings, and documentation.

Skills

Automation

Influence

Result Orientation

Stakeholder Management

Technical Strategy Development

Application Development

Architecture

Business Acumen

Risk Management

Solution Design

Agile Practices

Analytical Thinking

Collaboration

Data Management

Solution Delivery Process

Tools

Splunk

Python

Bash

Ansible

Terraform

GitOps

Job description

Bank of America is seeking a Principal Splunk Engineer to lead the design, operation, and evolution of a large-scale Splunk Enterprise / Splunk Cloud deployment across security, infrastructure, and applications. The platform ingests multi-terabyte daily data volumes and is central to SOC and threat detection.

Ideal candidates have deep SPL expertise, SmartStore/Indexer Clustering experience, and strong Python/Bash scripting with automation (Ansible, Terraform).