Splunk Technical Lead Enterprise Security & Platform

TechDoQuest; Dallas (TX); On-site; USD 110,000 - 140,000; Full time

Job summary

TechDoQuest is seeking a skilled Splunk engineer to administer Splunk Enterprise and SPL-based solutions. You will optimize data ingestion, parsing, indexing, and retention while building dashboards, alerts, and data models.

The role includes scripting with Python and Bash, SimpleXML, and contributing to automation and CI/CD initiatives. You will collaborate with clients to implement scalable Splunk architectures, perform upgrades, and provide knowledge transfer to project teams.

Qualifications

• Experience administering Splunk Enterprise and Splunk Enterprise Security.
• Onboarding and integrating enterprise apps and data sources into Splunk.
• Developing searches, dashboards, alerts, reports, and data models.

Responsibilities

• Administrate, configure, maintain, and support Splunk platforms and apps.
• Onboard and integrate enterprise data sources with proper ingestion and parsing.
• Develop and maintain SPL searches, dashboards, and operational content.
• Provide technical guidance and participate in upgrades and automation.
• Troubleshoot issues, document procedures, and mentor team members.

Skills

Splunk Enterprise

SPL

Python

Bash

CI/CD

Tools

SimpleXML

Automation scripts

Job description

Deliverables Administration, configuration, maintenance, and technical support of the Splunk Enterprise and Splunk Enterprise Security platforms. Successful onboarding and integration of assigned enterprise applications, systems, infrastructure, and log/data sources into Splunk. Configuration and optimization of log ingestion, parsing, normalization, indexing, retention, search performance, and data-management processes. Development, enhancement, and maintenance of Splunk searches, alerts, dashboards, reports, data models, applications, add-ons, and security/compliance content. Development and maintenance of custom Splunk solutions and automation using SPL, Python, Bash, SimpleXML and other applicable technologies. Technical recommendations and implementation support related to Splunk architecture, infrastructure standards, capacity, performance, scalability, high availability, upgrades, platform refreshes, and lifecycle management. Support for Splunk integrations with business-critical enterprise applications, cloud platforms, security technologies, and observability systems. Technical support for platform migrations, upgrades, deployment automation, CI/CD processes, and infrastructure modernization activities as assigned. Troubleshooting, root-cause analysis, and resolution recommendations for Splunk platform, ingestion, integration, performance, and production-support issues. Technical documentation covering configurations, architecture, integrations, deployment procedures, operational processes, troubleshooting procedures, and implemented solutions. Knowledge transfer, technical guidance, and mentoring to client and project team members regarding Splunk administration, engineering, architecture, and operational best practices.

Acceptance Criteria:

Services and deliverables will be considered acceptable when: Assigned Splunk platform administration, configuration, engineering, and support activities are completed in accordance with client requirements, established technical standards, and agreed project priorities. Assigned data sources and enterprise systems are successfully integrated into Splunk with data being properly ingested, parsed, normalized, indexed, searchable, and available for the intended operational, security, or analytical use. Developed or modified searches, dashboards, alerts, reports, data models, applications, add-ons, and security/compliance content operate as intended and satisfy documented functional requirements. Platform upgrades, infrastructure changes, migrations, and configuration modifications are implemented successfully without unresolved material impact to platform availability, reliability, security, or performance. Splunk platform performance and ingestion-related issues assigned to the Consultant are investigated and appropriately resolved, mitigated, or documented with actionable technical recommendations. Custom scripts, integrations, automation, and Splunk application components function according to agreed requirements and applicable client development and security standards. Technical solutions support applicable production requirements for availability, reliability, scalability, performance, monitoring, logging, and operational support. Required technical documentation is sufficiently complete and accurate to support ongoing administration, maintenance, troubleshooting, and knowledge transfer. Knowledge-transfer activities and technical guidance are provided as reasonably requested to enable designated client or project personnel to understand and support implemented solutions. Deliverables are reviewed and accepted by the designated client or project representative and any identified deficiencies are corrected within a mutually agreed timeframe.