Splunk ES Consultant

Job Summary

Working remotely on a contract basis, the Splunk ES Consultant will develop custom detection content, optimize data flow, and support large distributed clustered Splunk environments while partnering with client security teams.

Key responsibilities

• Develop custom detection content, including correlation searches and alerts, to identify threat activity
• Onboard new data sources and normalize them to the Common Information Model (CIM)
• Build and maintain dashboards that highlight anomalies and security metrics

Required qualifications

• Several years of hands-on Splunk experience with ES implementation and content development
• Strong skills in SPL and regular expressions
• Experience scripting in Python, Perl, or Bash
• Solid understanding of CIM and data onboarding at scale
• Proficiency in Linux and experience supporting clustered Splunk environments