Responsibilities :

• Deploy, setup, configure, manage, and maintain Splunk deployments to include clustering and high availability scenarios


• Ensure that all data ingestion sources are reporting accordingly to eliminate gaps in security monitoring


• Develop security-focused content in Splunk, including detection logic and operational dashboards


• Collaborates with analysts, engineers and threat hunters to deliver continuous cyber defense improvements


• Communicate with varied customer bases, including leadership and support roles


• Manage ticket request/incident statuses and provide timely follow up to internal and external customers


• Interface with customers to resolve issues, provide additional information, and answer questions


• Support Incident Response on security incidents


• Troubleshoot Linux and Windows systems


• Participate in projects/initiatives as needed


• Contribute to the integration of systems using APIs


• Provide functional solutions to complex technical problems


• Keep up-to-date with information security news, techniques, and trends


• Manage multiple priorities simultaneously while managing expectations and project milestones while under pressure
  
   

• Proficiency with engineering Splunk


• Linux System Administration (CentOS, RedHat, Ubuntu)


• Network Architecture


• Ticketing system response and hygiene


• Operational support in cybersecurity or information technology operations


• Written and verbal communications with varying levels of technical and cybersecurity maturity


• Independent self-starter


• Ability to pass a pre-employment background and drug screen in accordance with applicable laws
  
   

• Splunk Certifications (Architect preferred)


• Managed Services delivery


• Amazon Web Services (AWS)


• Microsoft Azure


• DevOps software (Ansible, Chef, Puppet, etc)


• Third-party threat intelligence tools as required


• Degree in Information Security or Information Technology


• Previous experience on a Computer Incident Response Team (CIRT), Computer Emergency Response Team (CERT), Computer Security Incident Response Center (CSIRC) or a Security Operations Center (SOC)