Must-Have
Robust knowledge of SPL (Search Processing Language).
Solid knowledge on IRs and Notables of SIEM and ITSI
Experience with onboarding data from various sources (syslog, APIs, cloud services, etc.).
Proficiency in scripting languages (Python, Bash, PowerShell).
Familiarity with DevOps tools (Git, Jenkins, Ansible, Terraform).
Should have good troubleshooting experience.
Good-to-Have Splunk certifications and Experience with Cribl and AppDynamics
SN
Role descriptions / Expectations from the Role
1
Design, develop, and maintain complex Splunk dashboards, queries, and alerts.
2
Onboard current data sources into Splunk using forwarders, APIs,
or custom scripts and Develop and maintain Splunk apps and technology add-ons (TAs).
3
Collaborate with security, infrastructure, and application teams to define logging standards and ensure data quality.
4
Optimize Splunk performance and manage indexing, parsing, and retention policies.
5
Implement and maintain role-based access controls (RBAC) and data models.
6
Support incident response and root cause analysis using Splunk.
7
Automate Splunk deployments and configurations using tools like Ansible, Terraform, or CI/CD pipelines.