Splunk SIEM Data Onboarding Engineer

Splunk SIEM Data Onboarding Engineer
*
* The Opportunity:

** The Splunk SIEM Data Onboarding Engineer is responsible for managing and enhancing our Splunk environment to ensure seamless data ingestion, analysis, and visualization. This role demands a deep understanding of Splunk architecture, data onboarding, and user management to support business needs and security operations.
** What You’ll Work On:
*** Design, deploy, and manage Splunk infrastructure.
* Develop and maintain Splunk dashboards, queries, and alerts.
* Integrate Splunk with various data sources to ensure comprehensive data ingestion.
* Monitor and troubleshoot Splunk performance issues.
* Collaborate with cross-functional teams to gather requirements and provide Splunk solutions.
* Implement and enforce best practices for Splunk data management and retention.
* Provide user training and support for Splunk-related activities.

Join us. The world can’t wait.
** You Have:
*** 2+ years of experience managing and configuring Splunk
* 2+ years of experience in Splunk architecture, including indexers, search heads, forwarders, and deployment server
* 2+ years of experience building pipelines to parse, normalize, enrich, mask or dedupe, and route data to Splunk
* 2+ years of experience in Linux and Windows administration
* Active TS/SCI clearance; willingness to take a polygraph exam
* Associate’s degree and 5+ years of experience supporting IT projects and activities, Bachelor’s degree and 3+ years of experience supporting IT projects and activities, Master’s degree and 1+ years of experience supporting IT projects and activities, or 10+ years of experience supporting IT projects and activities in lieu of a degree
* Ability to obtain a DoD 8570 IAT Level III Certification such as SecurityX, CCNP Security, CISA, CISSP, GCED, GCIH, or CCSP Certification, and a DoD 8570 Cyber Security Service Provider - Infrastructure Support Certification such as CEH, CySA+, GICSP, SSCP, CHFI, CFR, Cloud+, or CND Certification, within 30 days of start date
** Nice If You Have:
*** 2+ years of experience with networking fundamentals, including TCP/UDP, TLS, syslog transport, firewall ports, and common transport issues
* 2+ years of experience in basic troubleshooting with tools such as tcpdump or wireshark, basic vi/vim usage, setfacl, and SELinux
* 1+ years of experience with STIGs or other organizational hardening standards working in regulated environments
* 1+ years of experience with regex skills for field extraction and event breaking
* Experience in SPL for validation, troubleshooting, and basic dashboards
* Experience with scripting languages such as Python, Bash, or Power Shell
* Experience with Cribl sources, destinations, routes, and collectors
* Experience with Splunk REST API for automation and operational tasks
* Knowledge of Git for code version control
* Knowledge of Ansible playbooks
** Clearance:
** Applicants selected will be subject to a security investigation and may need to meet eligibility requirements for access to classified information; TS/SCI clearance is required.
** Compensation
* * At Booz Allen, we celebrate your contributions, provide you with opportunities and choices, and support your total well-being. Our offerings include health, life, disability, financial, and retirement benefits, as well as paid leave, professional development, tuition assistance, work-life programs, and dependent care. Our recognition awards program acknowledges employees for exceptional performance and superior demonstration of our values. Full-time and part-time employees working at least 20 hours a week on a regular basis are eligible to participate in Booz Allen’s benefit programs.

Individuals that do not meet the threshold are only eligible for select offerings,…