Data Intake & Integrations; D&I) Analyst- Mid; Splunk

Description

Pueo is seeking a Data Intake & Integrations (D&I) Analyst-Mid (Splunk) Analyst to join our unique team of multidisciplined experts onsite in McLean, VA.

The DI&I team is the gateway for all log and data sources entering TESIEMS, ensuring ingested data is normalized, structured, and tagged for maximum utility. The team measures deviations in log formats, enables data segregation by Treasury component and FISMA boundary, and leads the data framework that monitors key data metrics and identifies coverage or quality gaps. DI&I coordinates with federal stakeholders, bureau security teams, and third-party vendors to onboard and standardize data feeds;

leads rapid response when data pipelines are disrupted; supports SOC consolidation and multitenancy (alerts, notifications, content sharing, and access across bureaus); manages orchestration tasks such as audit-logging pipelines and ticketing automation; and integrates with asset management, compliance, and threat intelligence systems via APIs, connectors, and pipelines.

Provide operational and engineering support for the Department of the Treasury’s enterprise Splunk environment under the Treasury Enterprise SIEM (TESIEMS) program. The role administers Splunk, onboards new data sources, ensures data quality and normalization, and maintains continuous visibility across enterprise systems, enabling Treasury SOC teams to detect, analyze, and respond to cybersecurity threats and to meet compliance reporting requirements. More specifically:

• Perform day-to-day Splunk administration, including monitoring system health, managing indexes, and troubleshooting ingestion and search performance issues.
• Support Splunk operations in hybrid environments (on-premises servers, AWS compute/storage, Linux VMs).
• Apply patches, upgrades, and configurations to maintain the stability and compliance of Splunk infrastructure.
• Onboard new data sources into Splunk using syslog, HTTP Event Collector (HEC), JSON feeds, and APIs.
• Normalize and validate ingested data to align with the Splunk Common Information Model (CIM) and SOC use cases.
• Collaborate with system owners, engineers, and SOC analysts to configure log forwarding and resolve onboarding issues.
• Develop and maintain ingestion pipelines that support large-scale Treasury SOC operations.
• Tune parsing, field extractions, and source types for optimal indexing and search performance.
• Document and maintain data onboarding procedures, schemas, and configuration standards.
• Ensure Splunk onboarding and data retention configurations align with Treasury security and compliance requirements (NIST RMF and FISMA).
• Generate audit-ready intake documentation and data validation reports for compliance reviews.
• Work with compliance and CD&M teams to ensure Splunk data supports continuous monitoring and reporting mandates.
• Provide Tier II/III Splunk intake and administration support, escalating complex issues to senior Splunk engineers as required.
• Partner with SOC analysts and content engineers to ensure onboarded data supports detection, dashboards, and reporting needs.
• Contribute to DI&I process-improvement initiatives that streamline intake and optimize operational workflows

• Cybersecurity principles and practices, with broad understanding of related cybersecurity specialty areas.
• Splunk Enterprise architecture and the Splunk Common Information Model (CIM).
• Hybrid infrastructure: on-premises servers, AWS compute/storage, virtual machines, and Linux environments.
• Incident detection, incident response, and security event management.
• NIST SP 800-53, NIST RMF, FISMA, FedRAMP, and DISA STIGs, and their application in SOC environments.

• Splunk Enterprise administration…