Splunk / Cribl Engineer - Cybersecurity Engineering (Hybrid)

Responsibilities:
- Design, implement, and enhance robust streaming and batch data pipelines using message brokers to feed the SIEM and downstream analytics.
- Route, filter, and normalize/harmonize data using observability pipelines to create structured datasets from unstructured logs prior to SIEM ingestion.
- Build scalable data models and enhance standard schemas in data warehousing for reliable, cost-effective, query-optimized storage.
- Verify data integrity and translations across distributed systems and message topics; manage end-to-end data lineage.
- Analyze requirements for coding, API integrations, and programming to connect security telemetry sources into the SIEM, data warehouses, or other repositories.
- Execute testing plans, debug pipeline routing issues, and document data flows, routing configurations, and integration protocols.
- Perform compilation, cataloging, caching, and rapid retrieval of telemetry within the SIEM and associated data lakes.
- Create, manage, and support advanced analytics/reporting environments outside the primary SIEM for security analytics and hunting.
- Define data specifications and plan for capacity changes across streaming, routing, indexing, and storage.
- Develop and enforce data ingestion standards, parsing policies, and retention procedures.
- Analyze data sources to uncover trends, improve data quality, and recommend actions to security operations.
- Automate metrics aggregation and dissemination from the SIEM and data warehouses.

Qualifications:
Required:
- Bachelor’s (5 years) or Master’s (4 years)
- Experience writing/optimizing Splunk SPL; administering Splunk Enterprise and onboarding data sources
- Ability to develop SIEM data models/dictionaries/reports; build/configure data pipelines
- Regular expressions; parsing unstructured data
- Data administration/standardization policy knowledge
- Database management systems, query languages, table relationships, and views
- Validate datasets and calculations
- Work independently and collaboratively; learn quickly and adapt
- CI/CD pipelines and Git; database/system integration technologies

Preferred:
- Splunk certifications (Admin/Power User/Architect)
- Agile experience
- Cybersecurity/privacy knowledge
- ETL in SIEM environments (ELK/Splunk/Exabeam, etc.)
- Scripting/development tools (Python/PowerShell/Go)
- Analyze large datasets for patterns/anomalies/outliers
- Cribl certifications
- Amazon/Azure/cloud data engineering certifications

Benefits:
- Paid time off; medical/dental/vision; 401(k) (eligible employees)

Application instructions:
- Not provided in the posting.