Associate Splunk Engineer

Peraton is seeking a Splunk Engineer. A Splunk Engineer provides overall engineering, and administration support for a large distributed clustered Splunk Enterprise environment.  Integrates Splunk with other IT monitoring tools and management systems for seamless data collection, analysis, and visualization.  Demonstrates critical attention to detail, identifying and onboarding new data sources into Splunk based on customer requirements, following Splunk best practices.  Analyzes data for anomalies and trends and build advanced searching and reporting tools to highlight the key data trends.  Interacts with cross-functional teams and end users to gather requirements, perform troubleshooting, and identify the right mix of tools and techniques to translate customer’s needs and goals into effective monitoring solutions.  Frequent collaboration with the Splunk team and interaction with senior management, as necessary.

In support of the EEMTT team of the EITSI program, the Splunk Engineer is responsible for building out an enhanced enterprise monitoring platform utilizing Splunk.  Working closely with our primary DHA Infrastructure and Operations Division client, the Splunk Engineer will help shape enterprise solution requirements and guide new solution development activities.  The DHA Splunk enterprise solution is integrated with ServiceNow and many other service management monitoring systems to provide a monitoring intelligence hub for all of DHA.  The Splunk Engineer will support the EEMTT team to become an Enterprise Solution Provider that utilizes AI for IT operations to automate self-healing activities as well as incident monitoring and improved business/data analytics for program management.

Responsibilities:

• Demonstrates domain and expert technical knowledge of Splunk monitoring solutions
• Monitor Splunk system health, identify performance bottlenecks, and optimize configurations.
• Manage Splunk capacity planning and resource allocation
• Maintain data ingestion pipelines from diverse data sources (application logs, system logs, network traffic, etc.).
• Configure Splunk data inputs, indexes, and data processing pipelines to optimize data collection and analysis.
• Monitor data ingestion and troubleshoot data quality issues
• Leverage Splunk Enterprise Security (ES) to detect and investigate security incidents.
• Develop and maintain custom Splunk ES detection rules and correlation searches.
• Ensure compliance with relevant RMF security and industry regulations by monitoring and reporting on key data points.
• Provide technical training and support to Splunk users across the organization 
• Develop user documentation and best practices guides for Splunk usage 
• Provide technical expertise to assist senior leadership in shaping and achieving the organization's strategic vision, operational and tactical goals. 

• 5 years with BS/BA; 3 years with MS/MA; 0 years with PhD
• Active Public Trust Clearance
• Must be a US Citizen
• Proven experience with Splunk architecture
• Current active IAT II certification (Security+) with related Computing Environment (CE) Splunk certifications to comply with DoD 8570 and DoD 8140.03 requirements
• Experience in RMF or similar government IT certification and accreditation processes

• Strong customer service and communications skills, both oral and written

• Strong critical thinking skills that facilitate expedient problem solving

• Strong understanding of Splunk core functionalities, including search syntax, data models, and reporting capabilities 

• Experience in data analysis techniques and statistical methods 

• Experience with scripting languages like Python or PowerShell for automation 

• Knowledge of network protocols, system administration, and security concepts 

Desired Qualifications:

• Experience working within Military Health environments (preferred)
• Familiarity with ServiceNow (MHSSHD) ITSM ticketing system (preferred)