This role pays less than
54%
of similar roles. Most pay
$136,725–$216,000
— the shaded band above.
At the midpoint, this role pays about
$162k
versus about
$176k
for comparable roles.
Based on 240 similar postings.
Employer
About Booz Allen Hamilton
Booz Allen Hamilton is a management and technology consulting firm that provides analytics, digital, engineering, and cybersecurity solutions primarily to U.S. government agencies and commercial clients. Industry: Management & Technology Consulting
Booz Allen Hamilton currently has
1385 open roles
on FindRole.
Listed pay typically runs
$86,800–$198,000
across 911 roles with salary data.
The Splunk SIEM Data Onboarding Engineer is responsible for managing and enhancing the organization's Splunk environment to ensure seamless data ingestion, analysis, and visualization. Working within a security operations context, this individual will design, deploy, and manage Splunk infrastructure while developing dashboards, queries, and alerts. The role involves integrating various data sources, monitoring performance, and implementing best practices for data management and retention. Key technical requirements include expertise in Splunk architecture, including indexers, search heads, and forwarders; Linux and Windows administration; and building pipelines to parse, normalize, and route data. Candidates should possess skills in SPL, regex, Python, Bash, or PowerShell, along with experience using Cribl, the Splunk REST API, Git, and Ansible. The role specifically addresses technical challenges related to security operations and requires an active TS/SCI clearance for work in regulated environments.
Design, deploy, and manage Splunk infrastructure including indexers, search heads, and forwarders.
Build data pipelines to parse, normalize, enrich, mask, and route data into the Splunk environment.
Integrate diverse data sources to ensure comprehensive data ingestion for security operations.
Develop and maintain Splunk dashboards, complex queries, and automated alerts.
Monitor and troubleshoot Splunk performance issues and underlying infrastructure.
Implement best practices for data management, retention policies, and system hardening.
Provide technical training and support to users for Splunk-related activities.
What we're looking for
2+ years of experience managing and configuring Splunk.
2+ years of experience in Splunk architecture including indexers, search heads, forwarders, and deployment servers.
2+ years of experience building pipelines to parse, normalize, enrich, mask or dedupe, and route data to Splunk.
2+ years of experience in Linux and Windows administration.
Active TS/SCI clearance and willingness to take a polygraph exam.
Must meet specific education and experience combinations: Associate's with 5+ years, Bachelor's with 3+ years, Master's with 1+ year, or 10+ years of IT experience.
Ability to obtain DoD 8570 IAT Level III and Cyber Security Service Provider - Infrastructure Support certifications within 30 days of start date.
Experience with networking, troubleshooting tools (tcpdump/wireshark), regex, scripting (Python/Bash/PowerShell), Cribl, Splunk REST API, Git, or Ansible (preferred).
Splunk
SPL
Python
Puppet
Ansible
Linux
Git
CI/CD
infrastructure-as-code
Regex
Common Information Model
Splunk SOAR
Splunk Machine Learning Toolkit
EDR
Site Reliability Engineering
DevOps
OCI
FinOps
SQL
Python
Power BI
Tableau
Oracle Analytics
Business Intelligence
Cloud Architecture
Data Pipelines
Cost Optimization
Least Privilege Access
Audit Logging