Principal Infrastructure Engineer - Splunk Admin (SIEM)
BengaluruFull-time10–18 yrsPosted over a month ago
Leadership DevOps and cloud role at Global Delivery Center in Bengaluru. Needs 10+ years and an MCA, B.Tech or B.E..
About the role
Responsible for enterprise-wide observability and monitoring initiative. Seeking expert Splunk Admins for a critical enterprise-wide observability and monitoring initiative. This role is essential in designing, building, and implementing standardized data onboarding pipelines and configurations to bring applications into Splunk Enterprise and Splunk Enterprise Security platforms.
What you'll do
- Design and implement standardized data onboarding procedures and configurations for applications; establish repeatable patterns and templates
- Conduct technical onboarding of applications into Splunk Cloud: configure data inputs, create parsing rules, establish field extractions, and build data models
- Map application data and security events to Splunk Common Information Model (CIM); identify and document relevant SIEM use cases
- Build and optimize data models, lookups, and knowledge objects to support reporting, alerting, alerting rule creation, and compliance requirements
- Design and implement automated onboarding pipelines using Git-based configuration management, Ansible playbooks
What you need
- Splunk
- SIEM
- CI/CD
- Ansible
- Python
- Bash
Good to have
- Prometheus
- Incident response
- Git
- SOX
- Reconciliation