Splunk SIEM Data Ingestion Engineer

Booz Allen Hamilton; Washington (District of Columbia); On-site; USD 99,000 - 225,000; Full time

Job summary

Booz Allen Hamilton is seeking a Splunk SIEM Data Onboarding Engineer to manage and enhance our Splunk environment for data ingestion, analysis, and visualization.

The role requires strong Splunk architecture knowledge, data onboarding, and user management skills, with a TS/SCI clearance preferred. You will design, deploy, and optimize Splunk deployments while collaborating across teams to meet security operations needs.

Qualifications

• 2+ years of experience managing and configuring Splunk.
• 2+ years of experience in Splunk architecture (indexers, search heads, forwarders, deployment server).
• 2+ years of experience building pipelines to parse, normalize, enrich, mask or dedupe, and route data to Splunk.
• 2+ years of Linux and Windows administration.
• Active TS/SCI clearance and willingness to take a polygraph exam.
• Degrees/experience aligned with DoD requirements (degrees or 10+ years in lieu).
• Ability to obtain DoD 8570 certifications within 30 days of start date.

Responsibilities

• Design, deploy, and manage Splunk infrastructure.
• Develop and maintain Splunk dashboards, queries, and alerts.
• Integrate Splunk with data sources for comprehensive ingestion.
• Monitor and troubleshoot Splunk performance issues.
• Collaborate with cross-functional teams to gather requirements.
• Implement best practices for Splunk data management and retention.
• Provide user training and support for Splunk activities.

Skills

Splunk

Data onboarding

Linux/Windows admin

Security clearance TS/SCI

DoD 8570 certs

Networking fundamentals

Scripting (Python/Bash/PowerShell)

Regex & SPL

Git

Ansible

Education

Associates degree or higher in IT/CS

Bachelor's degree in IT/CS or related

Master's degree or 10+ years experience in lieu of degree

Tools

Splunk REST API

Cribl

Git

Ansible

Job description

Booz Allen Hamilton is seeking a Splunk SIEM Data Onboarding Engineer to manage and enhance our Splunk environment for data ingestion, analysis, and visualization.

The role requires strong Splunk architecture knowledge, data onboarding, and user management skills, with a TS/SCI clearance preferred. You will design, deploy, and optimize Splunk deployments while collaborating across teams to meet security operations needs.