Splunk ES Consultant

Job Summary

To support a growing cybersecurity initiative, the remote Splunk ES Consultant will develop custom detection content, build and maintain Splunk Apps, and optimize data flow while collaborating with client security teams on a contract basis.

Key responsibilities

• Develop custom detection content, including correlation searches and alerts, to identify threat activity
• Onboard new data sources and normalize them to the Common Information Model (CIM)
• Support and optimize large distributed clustered Splunk environments while documenting processes and key decisions

Required qualifications

• Several years of hands-on Splunk experience with ES implementation and content development
• Strong skills in SPL and regular expressions, along with scripting in Python, Perl, or Bash
• Solid understanding of CIM and experience with data onboarding and normalization at scale
• Experience supporting clustered Splunk environments in SOC or NOC settings
• Proficiency in Linux, including managing Splunk configuration files and apps