Splunk Performance & Content Engineer
Core
Optimize Splunk platform performance, remediate data quality issues, and develop/maintain detection content and dashboards for SOC operations.
Role type
Senior Splunk Performance & Content Engineer
Builds
Production Splunk dashboards, detection rules, data models, and optimized search infrastructure
Domain
Cybersecurity / SIEM (Splunk)
Required skills
Advanced SPL, Splunk data modeling, search performance tuning, index design, ITSI configuration, data normalization (props/transforms), MITRE ATT&CK mapping, content lifecycle management
Preferred skills
Splunk certifications (Power User/Admin/Architect), Splunk Observability Cloud, OpenTelemetry, Enterprise Security, Dashboard Studio, REST APIs, Splunk SDK, Python/Bash scripting, detection engineering
Technologies
Splunk, ITSI, MITRE ATT&CK, OpenTelemetry, Splunk Observability Cloud, Dashboard Studio, REST APIs, Splunk SDK
Responsibilities
Optimize SPL, scheduled searches, dashboards, data models, and summary indexing for performance; Remediate parsing, sourcetype, and ingestion issues; Monitor platform health and resource usage; Tune ITSI services and KPIs; Develop and maintain dashboards, alerts, and detection rules; Package Splunk content into apps and manage version control; Map detections to MITRE ATT&CK and reduce false positives; Collaborate with SOC and SRE teams on requirements; Maintain runbooks and knowledge articles.
Seniority
Senior, hands-on IC
