Senior Splunk Engineer — SIEM & Incident Response (On-site)

Experis; Richmond (VA); On-site; USD 58,000 - 96,000; Full time

Benefits offered by this job

Medical plan

Vision plan

HSA/FSA

Life Insurance

Disability Insurance

Travel Insurance

Weekly Pay

Job summary

Experis is seeking a Splunk Engineer to support an on-site, distributed Splunk Enterprise and Cloud environment across Richmond, VA; Charlotte, NC; and Pennington, NJ. The role emphasizes production support, incident response, and collaboration with Security Operations and Data Infrastructure teams.

The ideal candidate has extensive Splunk experience, strong Linux skills, and a track record of RCA and incident management.

Qualifications

• 5+ years hands-on Splunk administration including indexer and search head clustering.
• Deep expertise in SPL, search optimization, and data model acceleration.
• Strong Linux administration and Splunk configurations.
• Proven ability to lead production incidents and perform RCA.
• Excellent communication with technical and business stakeholders.

Responsibilities

• Own end-to-end production support for a highly distributed Splunk Enterprise and Splunk Cloud environment, ensuring high availability and performance.
• Lead incident response, troubleshooting, root cause analysis (RCA), and service restoration for Splunk and Cribl platforms.
• Serve as a technical enabler for Information Security and SOC teams, supporting security log ingestion and SIEM use cases.
• Administer and support Cribl environment for data routing, filtering, and enrichment to optimize data pipelines.
• Develop and maintain operational documentation, SOPs, and runbooks to ensure compliance and operational excellence.

Skills

Splunk

Linux

SPL

Incident response

Root cause analysis

Cribl

Tools

Cribl

Job description

Experis is seeking a Splunk Engineer to support an on-site, distributed Splunk Enterprise and Cloud environment across Richmond, VA; Charlotte, NC; and Pennington, NJ. The role emphasizes production support, incident response, and collaboration with Security Operations and Data Infrastructure teams.

The ideal candidate has extensive Splunk experience, strong Linux skills, and a track record of RCA and incident management.