Senior Splunk Engineer

ApplyLogic is a fast-growing Veteran-Owned consulting firm, headquartered in Dunn Loring, VA. Our people are our greatest asset and our company culture is grounded on that belief. We offer challenging and interesting work in a friendly and supportive environment. We deliver best-in-class technical expertise to the Federal Government market through IT professional service contracts.

We offer a competitive salary with a robust Fortune 500 type benefits package: employee assistance, employee adoption, 401K with match, medical, dental, vision, life, short-term and long-term disability, 15 paid time days off, 10 holidays, unlimited web-based training and up to $5K towards continuing education and/or professional development and more!

Founded in 2004, ApplyLogic is a Veteran Owned Small Business, ISO9001:2015 certified with over $7M annual revenues and 35 employees. Our growth has been recognized in the Washington Technology Fast 50 and the INC. 5000. We have an immediate Senior Splunk Engineer position available in Laurel, MD.

Job Description and Responsibilities:

The Senior Splunk Engineer will provide overall engineering and design support for a very large distributed Splunk environment consisting of heavy forwarders, indexers, and search head servers, spanning security, performance, and operational roles. The Splunk engineer will support the full system engineering life-cycle, including requirements analysis, design, development, integration, test, documentation, and implementation following defined best practices and operational workflows

• Designing, engineering, configuring and administering Splunk content
• Assisting in the proper operation and performance of Splunk, plug-ins, loggers and connectors
• Building Splunk reports
• Set up and configure Splunk search servers, deployment servers, clustered indexers, and forwarders, as required
• Configure Splunk integration points and verify functionality in the technical evaluation environment
• Developing dashboards with visual metrics for stakeholders
• Defining strategy and design around data collection, aggregations, and summarization processes
• Integrating external data sources into Splunk
• Enforcing best practices related to summarizing and querying data
• Developing advanced scripts for the manipulation of multiple data repositories to support analyst requirements
• Partnering with other enterprise teams to support data capture and advanced data analytics and forecasting efforts to support proactive identification of issues
• Providing recommendations and implement changes to optimize Splunk products in the customer environment
• Designing the Splunk system solution to meet growth while maintaining a balance between performance, stability, scalability and agility
• SIEM content management
• Ability to develop use cases, search and reporting scripts
• Create, optimize, and continuously evaluate security monitoring content (correlated searches/alerts) on Splunk ES.

Required Skills:

• 5 years of experience with Splunk, network security, system security, and supporting security information and event management (SIEM)
• Demonstrated experience in the implementation of information engineering projects; systems analysis, design and programming using standard tools and methods
• Create complex detection and alerting logic and log source onboarding for security focused content in our enterprise Splunk deployment.
• Ingest sources include: Networking (Load-Balancers, IPS, Firewalls), Operating Systems (Linux, Windows, UNIX), security tools, infrastructure, and applications.
• Engineer, configure, and deploy enterprise SIEM and log management solutions, develop automation for security tools management, and create customized searches and applications using programming and development expertise, including Java, Python, Shell scripting, and regular expression.
• Create and optimize Big Data correlations as a Splunk search language (SPL) expert.
• Skilled at Optimize/Tune logging source streams.
• Experience maintaining a fully operating SIEM solution.
• Strong technical knowledge of Amazon AWS products and services, such as EC2, BeanStalk, Lambda, VPC, Route53, Amazon FW, API Gateway, ELB, CloudTrail, CloudFront, and etc.
• Deep technical understanding of operating systems, network architecture and design, Active Directory (AD) application log consumables, systems design as well as superior knowledge of technical operations process and procedures
• Knowledge of encryption, key management and cryptology
• Knowledge with the Risk Management Framework (NIST 800-37), Security Controls as described in NIST 800-35, and the Federal Information Security Modernization Act (FISMA) operating standards and applicable guidelines

Education and Certifications

• Bachelor's Degree and 14 years of experience
• Splunk Certified Admin
• Splunk Certified Power User
• Splunk Certified Architect
• Splunk Certified Architect II

Clearance:

• U.S. Citizenship
• Public Trust, or must be able to obtain a Public Trust clearance