Senior Splunk Consultant

TeraSky; Illinois; On-site; USD 120,000 - 180,000; Full time

Job summary

TeraSky, a global technology solutions provider, seeks a Senior Splunk Consultant to lead hands-on delivery for enterprise customers across on‑premises, cloud and hybrid environments. You will architect Splunk platforms, onboard data, and implement Splunk Enterprise Security, including detections and dashboards, while guiding customers and contributing to presales with technical estimates.

You will mentor teams, optimize performance, and ensure successful security operations with SIEM, SOAR, and

Qualifications

• 5+ years of hands-on Splunk experience in production.
• 2+ years with Splunk Enterprise Security.
• Experience designing and managing distributed Splunk environments (search heads, indexers, forwarders, capacity planning and retention).
• Hands-on experience implementing and configuring Splunk Enterprise Security (correlation searches, MITRE ATT&CK-aligned detections, risk-based alerting, asset and identity enrichment).
• Strong SPL, CIM and data onboarding skills (props/transforms, field extractions, forwarders, HEC, syslog).
• Experience optimizing Splunk and ES performance (search tuning, data model acceleration, search scheduling, concurrency, detection tuning).
• Solid cybersecurity and networking knowledge (Windows/AD and Microsoft Entra ID logs; Linux; AWS/Azure/GCP).
• Strong analytical, troubleshooting and customer-facing skills.
• Scripting: Python, Bash or PowerShell; automation with Terraform or Ansible.
• Familiarity with Splunk AI Assistant and Splunk MCP Server (advantage).
• Relevant Splunk certifications or experience with SIEM migrations, SOAR playbooks, Edge/Ingest Processor, observability or CI/CD (advantage).

Responsibilities

• Design, implement and optimize Splunk Enterprise and Splunk Cloud Platform environments (architecture, sizing, retention, performance, troubleshooting).
• Deliver Splunk Enterprise Security solutions (data onboarding, CIM normalization, MITRE ATT&CK detections, risk-based alerting, dashboards, reports).
• Automate deployments and integrate security and ITSM platforms; support scoping, documentation, workshops and knowledge transfer.

Skills

Splunk

Splunk Enterprise Security

SPL

Data onboarding

MITRE ATT&CK

Python

Bash

PowerShell

Linux

Windows AD

AWS

Azure

GCP

Terraform

Ansible

SOAR

SIEM migrations

Observability

CI/CD

AI Assistant

Splunk MCP Server

Education

Splunk certifications

Tools

Terraform

Ansible

Job description

Senior Splunk Consultant

IL , Full-time

Description

TeraSky is a global technology solution integrator specializing in AI, Cloud, DevOps platforms and Data.Since 2010, we have helped more than 1,000 organizations adopt advanced technologies through over 4,000 complex deployments, including Kubernetes platforms, modern data environments, and Generative AI solutions. Our team of 300+ experts works closely with leading technology partners, including AWS, Microsoft, Google, and VMware, to design, implement, and operate scalable enterprise environments.

If you’re excited about working with leading experts, modern technologies, and complex, high-impact projects, TeraSky offers an environment where you can grow and make a real impact

We are looking for a Senior Splunk Consultant to serve as the main technical delivery authority for our Splunk practice. You will lead hands‑on delivery for enterprise customers, from platform architecture and data onboarding to Splunk Enterprise Security, security integrations and platform optimization. Depending on project needs, you will also support SOAR, observability, SIEM migrations and security proofs of concept.

As a trusted technical advisor, you will guide customers across on‑premises, cloud and hybrid environments, translate business and security needs into practical solutions, and help define technical standards for the practice. You will contribute to presales discussions, solution scoping and delivery estimates, combining deep technical expertise with clear communication.

Customer self‑sufficiency is central to the role. Through documentation, workshops and mentoring, you will equip customer teams to operate, troubleshoot, tune and evolve their Splunk environments independently.

Responsibilities

• Design, implement and optimize Splunk Enterprise and Splunk Cloud Platform environments, including architecture, sizing, retention, performance tuning and troubleshooting.
• Deliver Splunk Enterprise Security solutions, including data onboarding, CIM normalization, MITRE ATT&CK-aligned detections, risk‑based alerting, dashboards and reports.
• Automate deployments and integrate security and ITSM platforms; support solution scoping, technical documentation, workshops and customer knowledge transfer.

Requirements

• 5+ years of hands‑on Splunk experiencein production, including 2+ years with Splunk Enterprise Security.
• Proven experience designing and managing distributed Splunk environments, including search heads, indexers, forwarders, capacity planning and retention configuration.
• Hands‑on experience implementing and configuring Splunk Enterprise Security, including correlation searches, MITRE ATT&CK-aligned detections, risk‑based alerting, and asset and identity enrichment.
• Strong SPL, CIM and data onboarding skills, including props/transforms, field extractions, forwarders, HEC and syslog.
• Experience optimizing Splunk and ES performance, including search tuning, data model acceleration, search scheduling and concurrency, and detection tuning to reduce false positives.
• Solid cybersecurity and networking knowledge, including Windows / Active Directory and Microsoft Entra ID security logs; hands‑on experience with Linux and at least one major cloud provider- AWS, Azure or GCP.
• Strong analytical, troubleshooting and customer‑facing skills
• scripting skills in Python, Bash or PowerShell, and deployment/configuration automation experience with Terraform or Ansible.
• Familiarity with Splunk AI Assistant and Splunk MCP Serverfor search, investigation and operational workflows - advantage.
• Relevant Splunk certifications, or experience with SIEM migrations, SOAR playbooks, Edge/Ingest Processor, observability solutions or CI/CD - advantage.