Splunk ES Consultant

Job Summary

To enhance security operations, the remote Splunk ES Consultant will develop custom detection content, build and maintain Splunk Apps, and optimize data flow while collaborating with client security teams on a contract basis.

Key responsibilities

• Develop custom detection content, including correlation searches and alerts, to identify threat activity
• Onboard new data sources and ensure normalization to the Common Information Model (CIM)
• Support and optimize large distributed clustered Splunk environments while documenting processes and procedures

Required qualifications

• Several years of hands-on Splunk experience with ES implementation and content development
• Strong proficiency in SPL, regular expressions, and scripting languages such as Python, Perl, or Bash
• Solid understanding of CIM and experience with data onboarding and normalization at scale
• Experience supporting clustered Splunk environments in SOC or NOC settings
• Proficiency in Linux, including managing Splunk configuration files and applications