Splunk D&I Analyst: Data Onboarding & SIEM Ops

Pueo Business Solutions LLC; McLean (VA); On-site; USD 102,000 - 142,000; Full time

Job summary

Pueo is seeking a Data Intake & Integrations (D&I) Analyst-Mid (Splunk) to join our team onsite in McLean, VA. You will administer the enterprise Splunk environment, onboard new data sources, ensure data quality, and maintain visibility across Treasury systems to support SOC detection, analysis, and compliance reporting.

The role requires Splunk Core Certified User, 7+ years of relevant experience, US citizenship, and an active Secret clearance.

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or related field.
• Seven (7) years of relevant experience.
• Must be a US citizen.
• Active Secret clearance required (interim Secret not accepted).
• Splunk Core Certified User is required.

Responsibilities

• Provide operational and engineering support for the Treasury’s TESIEMS Splunk environment.
• Administer Splunk, onboard new data sources, ensure data quality and normalization, maintain visibility across enterprise systems.
• Perform day-to-day Splunk administration, monitor health, manage indexes, troubleshoot performance issues.
• Onboard data sources using syslog, HTTP Event Collector, JSON feeds, and APIs.
• Normalize data to CIM standards and align with SOC use cases.
• Collaborate with system owners and SOC analysts to configure log forwarding and resolve onboarding issues.
• Develop ingestion pipelines for large-scale Treasury SOC operations.
• Tune parsing and field extractions for optimal indexing and search.
• Document data onboarding procedures and configuration standards.
• Ensure onboarding and data retention align with NIST RMF and FISMA.

Skills

Splunk administration

Data onboarding

Log normalization

Scripting & automation

Security tools usage

Technical documentation

Education

Bachelor’s degree in Cybersecurity/CS/IT

Tools

Splunk

Syslog

HEC

JSON

APIs

Linux

Job description

Pueo is seeking a Data Intake & Integrations (D&I) Analyst-Mid (Splunk) to join our team onsite in McLean, VA. You will administer the enterprise Splunk environment, onboard new data sources, ensure data quality, and maintain visibility across Treasury systems to support SOC detection, analysis, and compliance reporting.

The role requires Splunk Core Certified User, 7+ years of relevant experience, US citizenship, and an active Secret clearance.