Senior Splunk Architect — Remote ITSI, SOAR & Security Ops

GovCIO; United States; On-site; USD 105,000 - 145,000; Full time

Job summary

GovCIO is hiring a Senior Splunk Engineer - Infrastructure Operations to support the AOUSC NLS project. The role involves designing, implementing, and operating Splunk Core, Enterprise Security, ITSI, Phantom (SOAR), Splunk Cloud, Splunk On-Call, and multi-site index clustering.

The candidate will monitor health via the DMC, manage ingestion and parsing, optimize searches and dashboards, rotate credentials, and collaborate with the Engineering team on escalations and RCA findings.

Qualifications

• Bachelor's degree or commensurate experience with 10 years in the field, or a Master’s degree with 7+ years.
• Experience designing, implementing, and operating large Splunk environments.
• Strong knowledge of Enterprise Security, ITSI, and SOAR.

Responsibilities

• Design, implement, and operate Splunk Core, ES, ITSI, Phantom/SOAR, Splunk Cloud, and multi-site indexers.
• Monitor health using DMC, track indexing rates, license usage, and search concurrency.
• Troubleshoot data ingestion, parsing, and indexing across forwarders and HEC endpoints.
• Validate sourcetype, timestamps, and field extractions for new data sources.
• Maintain data flow visibility from source to indexer and manage credentials and RBAC.
• Provide end-user support for SPL searches, dashboards, and alerts; document incidents and RCA findings.
• Collaborate with Engineering on escalations, root cause analyses, and deployments.

Skills

Enterprise Security

ITSI

SOAR

Splunk Cloud

Education

Bachelor's degree (or commensurate experience)

Master's degree or higher (related discipline)

Tools

Splunk Core

Splunk Enterprise Security

Splunk ITSI

Splunk Phantom / SOAR

Job description

GovCIO is hiring a Senior Splunk Engineer - Infrastructure Operations to support the AOUSC NLS project. The role involves designing, implementing, and operating Splunk Core, Enterprise Security, ITSI, Phantom (SOAR), Splunk Cloud, Splunk On-Call, and multi-site index clustering.

The candidate will monitor health via the DMC, manage ingestion and parsing, optimize searches and dashboards, rotate credentials, and collaborate with the Engineering team on escalations and RCA findings.