Splunk Onboarding Specialist & Content Engineer

First Horizon Bank; Memphis (TN); On-site; USD 95,000 - 125,000; Full time

Job summary

First Horizon Bank in Memphis seeks a Splunk Onboarding and Content Engineer to turn security, audit, operational, and business logs into useful, reliable Splunk capabilities.

This role coordinates onboarding from discovery through production validation and partners with application owners to develop dashboards, alerts, and reports that improve visibility, investigation, compliance, and operational decision-making.

Qualifications

• Experience using Splunk Enterprise or Splunk Cloud to search, analyze, visualize, and alert on machine data.
• Hands-on proficiency with Search Processing Language (SPL) including filtering, aggregation, field extraction, lookups, time-based analysis.
• Experience building production dashboards, alerts, reports, and scheduled searches for technical or business stakeholders.
• Experience coordinating technical work across application owners, engineering, infrastructure, security teams, vendors, and project stakeholders.
• Working knowledge of log collection and transport concepts such as agents/forwarders, syslog, REST APIs, databases, cloud services, and structured data formats.
• Ability to review sample events, identify data-quality issues, and explain logging gaps in business terms.
• Strong troubleshooting across apps, OS, networks, identities, permissions, and data pipelines.
• Clear written and verbal communication, including leading discovery sessions and documenting decisions.

Responsibilities

• Serve as the primary coordinator for application log onboarding into Splunk, managing intake, discovery, requirements, dependencies, testing, and handoff.
• Partner with application owners, developers, infrastructure, security teams, risk partners, and vendors to identify log sources, environments, retention, and priority use cases.
• Assess proposed log sources for security, audit, compliance, and operational value; distinguish high-value telemetry from low-value data.
• Gather host names, file paths, APIs, database connections, cloud services, event streams, and sample events for onboarding.
• Coordinate onboarding across universal forwarders, syslog, APIs, cloud integrations, and Splunk add-ons.
• Validate data flow, timestamps, sourcetype assignments, field extraction, event breaking, permissions, and search performance.
• Normalize and enrich data using CIM, field aliases, calculated fields, tags, and lookups.
• Develop dashboards, alerts, correlation searches, reports, and reusable search content aligned with owner needs.
• Facilitate use-case workshops translating questions into Splunk content for onboarding.
• Test alerts/dashboards with stakeholders, tune thresholds, and document expected behavior and escalation paths.
• Identify sensitive information in logs and coordinate with data owners on masking and retention.
• Troubleshoot onboarding issues across connectivity, data quality, permissions, and configurations.
• Maintain onboarding status, risks, blockers, metrics, and docs in ticketing/knowledge systems.
• Create runbooks, data dictionaries, dashboards guides, and support documentation for sustainable ownership.
• Provide demos and knowledge transfer to help teams adopt the content.

Skills

Splunk Enterprise

Splunk Cloud

Search Processing Language

Dashboards & Alerts

Log collection & transport

Stakeholder coordination

Troubleshooting

Documentation

Tools

Splunk CIM

Data models

Splunk Add-ons

Job description

First Horizon Bank in Memphis seeks a Splunk Onboarding and Content Engineer to turn security, audit, operational, and business logs into useful, reliable Splunk capabilities.

This role coordinates onboarding from discovery through production validation and partners with application owners to develop dashboards, alerts, and reports that improve visibility, investigation, compliance, and operational decision-making.