Splunk SIEM Data Ingestion Engineer

Booz Allen Hamilton; College Park (MD); On-site; USD 99,000 - 225,000; Full time

Job summary

Booz Allen Hamilton is seeking a Splunk SIEM Data Onboarding Engineer to manage and enhance the Splunk environment for seamless data ingestion, analysis, and visualization. The role requires deep Splunk architecture knowledge, data onboarding skills, and strong collaboration with security operations teams.

Qualifications include 2+ years in Splunk, Linux/Windows administration, and active TS/SCI clearance. The position emphasizes deployment, scripting, and automation with certifications within

Qualifications

• 2+ years of experience managing and configuring Splunk.
• 2+ years of experience in Splunk architecture (indexers, search heads, forwarders, deployment server).
• 2+ years of experience building pipelines to parse, normalize, enrich, mask or dedupe, and route data to Splunk.
• 2+ years of experience in Linux and Windows administration.
• Active TS/SCI clearance; willingness to take a polygraph exam.
• Ability to obtain DoD 8570 IAT Level III and CSIS/CEH-type certs within 30 days of start.

Responsibilities

• Design, deploy, and manage Splunk infrastructure.
• Develop and maintain Splunk dashboards, queries, and alerts.
• Integrate Splunk with various data sources for comprehensive ingestion.
• Monitor and troubleshoot Splunk performance issues.
• Collaborate with cross-functional teams to gather requirements and provide Splunk solutions.
• Enforce best practices for Splunk data management and retention.
• Provide user training and support for Splunk activities.

Skills

Splunk administration

Splunk architecture

Data onboarding

Linux administration

Windows administration

Clearance TS/SCI

DoD 8570 certifications

Education

A.A./B.A./M.A. degree options or 10+ years experience in lieu

Tools

Splunk

Cribl

Git

Ansible

Python

PowerShell

REST API

Job description

Booz Allen Hamilton is seeking a Splunk SIEM Data Onboarding Engineer to manage and enhance the Splunk environment for seamless data ingestion, analysis, and visualization. The role requires deep Splunk architecture knowledge, data onboarding skills, and strong collaboration with security operations teams.

Qualifications include 2+ years in Splunk, Linux/Windows administration, and active TS/SCI clearance. The position emphasizes deployment, scripting, and automation with certifications within