Role & responsibilities :

- Extensive hands-on experience with Splunk Enterprise in a large or complex environment.
- Strong experience with Splunk Enterprise Security and SIEM security use cases.
- Practical cybersecurity experience in at least three of the following areas: detection engineering, threat hunting, security operations, incident response, security monitoring, threat intelligence, cloud security monitoring, or identity security monitoring.
- Solid knowledge of Splunk architecture, including indexers, search heads, forwarders, deployment servers, clustering, and monitoring.
- Advanced proficiency in SPL, including complex searches, data correlation, field extraction, optimization, and troubleshooting.
- Experience onboarding and managing high-volume security log sources.
- Experience tuning correlation searches and reducing false positives.

Preferred candidate profile

- Experience with risk-based alerting, security content management,



data models, and the Splunk Common Information Model.
- Experience integrating Splunk with SOAR, case-management, threat-intelligence, vulnerability-management, cloud-security, endpoint, and identity platforms.
- Knowledge of MITRE ATT&CK; and other relevant cybersecurity frameworks.
- Experience with cloud and SaaS security telemetry from Microsoft Azure, Microsoft 365, AWS, or Google Cloud.
- Experience with Python, PowerShell, shell scripting, REST APIs, or comparable technologies.
- Understanding of infrastructure-as-code, configuration management, source control, and CI/CD practices for SIEM content.
- Experience supporting audit or regulatory logging requirements.

Experience operating large, distributed, or multi-site Splunk environments

📌 Cyber Security Architect (Chennai)
🏢 Bahwan Cybertek
📍 Chennai