Senior Splunk SIEM Engineer (DoD)

SEMAIS; Columbus (OH); On-site; USD 120,000 - 165,000; Full time

Job summary

SEMAIS in the United States is seeking a skilled Splunk Engineer to sustain the log collection and SIEM tier for a DoD logistics enterprise. You will manage on-premises collection, Cribl, and Splunk components, building dashboards and content to elevate threats to incident responders.

Responsibilities include maintaining Splunk ES, scripting in Python, and developing custom connectors to enable telemetry from diverse systems, in a mission-focused environment with DoD secrecy requirements.

Qualifications

• Seven years of relevant information technology experience.
• Experience with Splunk Core and Splunk Enterprise Security.
• Ability to build custom dashboards and reports from threat data.
• Develop integrations using Python and REST/SOAP.

Responsibilities

• Research, plan, install, configure, troubleshoot, maintain, and back up every component of the enterprise log management architecture.
• Own on-premises collection tier feeding an enterprise Splunk Cloud environment, including Cribl and Splunk Forwarders; manage patches and access controls.
• Build and maintain pipelines that ingest and route logs, optimizing ingest costs.
• Create customized dashboards in Splunk ES; develop rules, reports, and data monitors for threat identification.
• Develop operational dashboards and monitors for pipeline and SIEM health; monitor events per second and license usage.
• Collaborate with DLA CERT to route, mask, and parse threat data for hunting.
• Develop custom connectors with Python and REST/SOAP to enable telemetry from non-standard apps.

Skills

Splunk ES dashboards

Threat analysis

Python scripting

REST integration

SSH/Unix/Linux admin

Tools

Splunk

Cribl

Splunk Cloud

Python

REST API

SOAP API

Job description

SEMAIS in the United States is seeking a skilled Splunk Engineer to sustain the log collection and SIEM tier for a DoD logistics enterprise. You will manage on-premises collection, Cribl, and Splunk components, building dashboards and content to elevate threats to incident responders.

Responsibilities include maintaining Splunk ES, scripting in Python, and developing custom connectors to enable telemetry from diverse systems, in a mission-focused environment with DoD secrecy requirements.