Splunk ITSI Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee the design, implementation, hardening, configuration, and operationalization of Splunk ITSI alongside the current Splunk engineering team.

• Ingest and normalize telemetry related to security, applications, and infrastructure from various data sources.

• Evaluate log quality, field consistency, and collection methodologies.

• Establish ITSI entities, services, KPIs, thresholds, and dependencies for proactive monitoring of service health.

• Create and refine Notable Event Aggregation Policies to correlate associated events and minimize duplicate alerts.

• Develop Glass Tables, Deep Dives, and executive dashboards that illustrate real-time service health, trends, and operational risks.

• Align service health models and alerting mechanisms with vulnerability management priorities and stakeholders in Government cybersecurity and operations.

• Configure and troubleshoot Splunk searches, alerts, reports, visualizations, add-ons, and data onboarding processes.

• Ensure secure configuration and access controls are in compliance with DoD and DON requirements, DISA STIGs, and the Risk Management Framework.

• Validate data flows, ITSI calculations, dashboards, and event grouping; adjust configurations as operational requirements evolve.

• Document architecture, configurations, standard operating procedures, lessons learned, and best practices.

• Conduct training and knowledge transfer sessions for NAVSUP BSC personnel.

• Provide weekly updates on completed tasks, outstanding work, dependencies, and any issues encountered.

⛳️ Requirements

• Proven experience in designing, installing, administering, and troubleshooting Splunk ITSI within a Splunk Enterprise environment.

• Capability to model IT services, entities, KPIs, health scores, thresholds, and dependencies.

• Familiarity with ITSI Glass Tables, Deep Dives, Event Analytics, Notable Event Aggregation Policies, and Episode Review.

• Strong proficiency in Splunk Search Processing Language (SPL) and experience in developing searches, alerts, reports, dashboards, and data models.

• Experience in onboarding, normalizing, and correlating logs and telemetry from security, application, and infrastructure systems.

• Knowledge of Splunk forwarders, search and deployment servers, clustered indexers, add-ons, and data collection methods such as Syslog, JDBC, and APIs.

• Experience with both Linux and Windows environments, along with Splunk configuration files, field extractions, lookups, and access controls.

• Ability to collaborate with Government cybersecurity and operations teams on vulnerability priorities, secure configurations, continuous monitoring, auditing, and reporting.

• Proven experience in developing technical documentation, training users, communicating progress, and resolving inter-team dependencies.

• A Bachelor’s degree in a technical discipline, such as engineering or computer science, is required.

• CompTIA Security+ CE certification or an equivalent certification approved for the position is required.

• One of the following Splunk certifications is mandatory: Splunk IT Service Intelligence Certified Admin (Legacy), Splunk Enterprise Certified Admin, Splunk Enterprise Certified Architect, Splunk Cloud Certified Admin, Splunk Enterprise Security Certified Admin, or Splunk Certified Developer.

• Experience in a Government or DoD environment is preferred.

🏝️ Benefits

• Medical, dental, and vision insurance.

• Health Savings Accounts (HSAs) and Flexible Spending Accounts (FSAs).

• 401(k) retirement plan with employer contributions.

• Paid time off and holidays.

• Life and disability insurance.

• Employee assistance programs.

• Tuition assistance and opportunities for professional development.

• Military differential pay.

• Additional voluntary benefit programs.