Splunk Performance & Content Engineer
Core
Optimize Splunk search performance, tune content (dashboards, alerts, data models), and maintain system health for security and IT operations monitoring.
Role type
Senior Splunk Performance & Content Engineer
Builds
Splunk dashboards, reports, alerts, correlation searches, detection rules, and CIM-compliant data models
Domain
IT Operations / Security Monitoring / Observability
Required skills
Advanced SPL tuning, Data Model Acceleration, Summary Indexing, ITSI KPI/Episode tuning, Props/Transforms configuration, Search performance analysis, Content lifecycle management, MITRE ATT&CK mapping
Preferred skills
Splunk Certified Power User/Admin/Architect, Python/Bash scripting, Splunk Enterprise Security, Dashboard Studio, REST APIs, Splunk SDK
Technologies
Splunk, ITSI, CIM, MITRE ATT&CK, Python, Bash
Responsibilities
Tune SPL and scheduled searches for performance; Remediate data quality issues (parsing, sourcetype, indexing); Design and maintain security dashboards and detection rules; Optimize data ingestion and index design; Monitor system health and report trends; Maintain knowledge articles and runbooks
Seniority
Senior, hands-on IC
