Splunk / Cribl Engineer, Cybersecurity Engineering

What you'll do

• Design and implement robust streaming and batch data pipelines using message brokers for SIEM and analytics engines.
• Route, filter, and normalize unstructured logs into structured datasets before ingestion into the SIEM.
• Build scalable data models and enhance standard schemas within data warehousing solutions to optimize storage and queries.
• Verify data integrity and manage end-to-end data lineage across distributed systems and message topics.
• Integrate disparate security telemetry sources into the SIEM, data warehouses, and other repositories via APIs and coding.
• Execute testing plans, debug pipeline routing issues, and document data flows and integration protocols.
• Manage the cataloging, caching, and retrieval of telemetry within the SIEM and associated data lakes.
• Develop automated systems for metrics aggregation and reporting to provide actionable insights for security operations.

What we're looking for

• Bachelor's Degree with 5 years of experience or a Master's Degree with 4 years of experience.
• Experience writing and optimizing Splunk Search Processing Language (SPL).
• Proven ability to administer Splunk Enterprise and onboard data sources.
• Skills in developing data models, dictionaries, and reports within a SIEM platform.
• Experience building and configuring data pipelines and using regular expressions to parse unstructured data.
• Knowledge of database management systems, query languages, table relationships, and views.
• Experience with CI/CD Pipelines, Git, and database or system integration technologies.
• Splunk, Cribl, or Cloud certifications (preferred); experience with Agile, Python, PowerShell, Go, and ETL in a SIEM environment (preferred).