Splunk Security Engineer TS​/SCI Meade, MD Security Clearance

Position: Splunk Security Engineer (5384) (TS/SCI) (Ft. Meade, MD) with Security Clearance
SMX is seeking a Splunk Engineer responsible for implementing, configuring, and managing Splunk environments to support the organization's data analytics, security, and operational goals. This role focuses on onboarding new data sources, optimizing search queries, building dashboards and reports, and maintaining the stability of the Splunk infrastructure. The scope of this position includes all Army Intelligence security domains as defined by the Cybersecurity Director, and the Splunk Engineer will verify that all solutions and configurations meet the required security standards and compliance requirements.

Additionally, the Splunk Engineer is responsible for ensuring ICS 500-27 audit compliance, maintaining the integrity and security of the Splunk system, and collaborating closely with analysts and architects to implement data solutions that provide real-time visibility into critical systems and processes. This is a full-time onsite position in Ft. Meade, MD.

Essential Duties & Responsibilities
* SIEM Platform Migration (Splunk to Elastic)
* Lead the end-to-end migration of the enterprise Security Information and Event Management (SIEM) capability from Splunk to the Elastic Stack (Elasticsearch, Logstash, Kibana), including planning, stakeholder coordination, execution, and post-migration validation to ensure zero degradation in security monitoring and detection coverage.
* Develop and manage the migration roadmap and program schedule, defining phased cutover milestones, resource requirements, and risk mitigation strategies while ensuring parallel operation of both platforms during transition to maintain continuous threat detection and incident response readiness.
* Splunk Implementation and Maintenance:
* Set up and configure Splunk instances, including forwarders, indexers, and search heads.
* Onboard new data sources into Splunk while ensuring proper parsing, field extraction, and indexing.
* Manage Splunk licenses, user access controls, and configurations to maintain stability and security.
* Data Analysis and Visualization:
* Build and optimize dashboards, alerts, and reports for security monitoring, IT operations, and business use cases.
* Develop and enhance Splunk Search Processing Language (SPL) queries to facilitate advanced analytics.
* Collaborate with teams to ensure that data sources meet the requirements for analysis and visualization.
* Troubleshooting and Performance Tuning:
* Monitor the health of the Splunk system, identify issues, and implement solutions to maintain high availability and performance.
* Optimize queries, alerts, and settings to lower resource use and improve efficiency.
* Resolve data ingestion and indexing issues.
* Service Level Agreement (SLA) Management and Monitoring: •
* Maintain and monitor the Service Level Agreement (SLA) of the Splunk system, ensuring that the system meets the required uptime, performance, and data ingestion targets.
* Monitor the ingest of data sources, particularly high-value or high-impact systems, and alert stakeholders when these systems stop sending events or experience disruptions.
* Develop and implement monitoring dashboards and alerts to quickly identify and respond to SLA breaches or data ingest issues.
* Disaster Recovery and High Availability:
* Design and implement disaster recovery and high availability solutions for the Splunk system, ensuring minimal downtime and data loss in the event of a disaster or system failure.
* Develop and maintain disaster recovery plans, including backup and restore procedures, to ensure business continuity.
* Configure and manage Splunk clustering, replication, and indexing to ensure high availability and redundancy.
* Compliance and Security:
* Maintain RMF (Risk Management Framework) ATO (Authority to Operate) compliance for the Splunk system, ensuring that all security controls and configurations are in place and up-to-date.
* Ensure STIG (Security Technical Implementation Guide) compliance for the Splunk system, including configuration and vulnerability management.
* Maintain accurate and up-to-date documentation, including:
* Data flow diagrams to illustrate data ingestion…