Principal Infrastructure Engineer - Splunk Admin (SIEM)

About the role

Responsible for enterprise-wide observability and monitoring initiative. Seeking expert Splunk Admins for a critical enterprise-wide observability and monitoring initiative. This role is essential in designing, building, and implementing standardized data onboarding pipelines and configurations to bring applications into Splunk Enterprise and Splunk Enterprise Security platforms.

What you'll do

• Design and implement standardized data onboarding procedures and configurations for applications; establish repeatable patterns and templates
• Conduct technical onboarding of applications into Splunk Cloud: configure data inputs, create parsing rules, establish field extractions, and build data models
• Map application data and security events to Splunk Common Information Model (CIM); identify and document relevant SIEM use cases
• Build and optimize data models, lookups, and knowledge objects to support reporting, alerting, alerting rule creation, and compliance requirements
• Design and implement automated onboarding pipelines using Git-based configuration management, Ansible playbooks

What you need

• 10–18 yrs of experience
• Splunk
• SIEM
• CI/CD
• Ansible
• Python
• Bash
• MCA or B.Tech or B.E. or B.Sc or BCA

Good to have

• Prometheus
• Incident response
• Git
• SOX
• Reconciliation