Splunk Developer

We are seeking a skilled Splunk Developer to design, develop, implement, and maintain enterprise Splunk solutions for log management, security monitoring, operational intelligence, and data analytics. The ideal candidate will have expertise in Splunk Enterprise, Splunk Enterprise Security (ES), SPL (Search Processing Language), dashboard development, data onboarding, and automation. This role requires close collaboration with Security Operations (SOC), Infrastructure, DevOps, Application, and Cloud teams to deliver scalable monitoring and analytics solutions.

Key Responsibilities

• Design, develop, and maintain Splunk dashboards, reports, alerts, and visualizations.
• Develop complex searches, correlation rules, and analytics using Splunk Search Processing Language (SPL).
• Configure and manage data ingestion from servers, applications, cloud platforms, databases, and network devices.
• Develop and maintain custom knowledge objects, including field extractions, lookups, tags, event types, and macros.
• Build and optimize Splunk data models and accelerate searches for improved performance.
• Configure and manage Splunk Enterprise Security (ES), correlation searches, risk-based alerting, and notable events.
• Develop custom Splunk apps and integrations using REST APIs, Python, and SDKs.
• Integrate Splunk with security tools, SIEM platforms, ITSM solutions, and cloud services.
• Monitor Splunk platform health, indexing performance, storage, and licensing.
• Troubleshoot data ingestion, search performance, and platform issues.
• Collaborate with security, infrastructure, and application teams to implement monitoring and alerting solutions.
• Create technical documentation, operational runbooks, and deployment guides.
• Participate in platform upgrades, migrations, and capacity planning.
• Support compliance reporting and audit requirements.

Required Qualifications

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related field.
• 3–8+ years of experience with Splunk Enterprise development and administration.
• Strong expertise in Splunk Search Processing Language (SPL).
• Experience developing dashboards, reports, alerts, and data visualizations.
• Experience onboarding data from Windows, Linux, cloud platforms, network devices, and applications.
• Knowledge of Splunk Enterprise Security (ES) or other SIEM platforms.
• Experience with scripting using Python, PowerShell, or Bash.
• Strong troubleshooting and analytical skills.
• Excellent communication and documentation abilities.

Preferred Qualifications

• Splunk Core Certified Power User.
• Splunk Enterprise Certified Admin.
• Splunk Enterprise Certified Architect.
• Splunk Enterprise Security Certified Admin.
• Experience with MITRE ATT&CK framework.
• Knowledge of cybersecurity monitoring and threat detection.
• Experience with SIEM, SOAR, and SOC operations.
• Familiarity with Agile/Scrum methodologies.

Nice to Have

• Experience with SOC operations and incident response.
• Knowledge of cybersecurity frameworks (NIST, ISO 27001, CIS Controls).
• Experience with machine learning or Splunk MLTK (Machine Learning Toolkit).
• Experience integrating Splunk with cloud-native monitoring tools.
• Familiarity with DevSecOps practices and Infrastructure as Code (IaC).