Security Monitoring – Splunk Engineer

Job description

As a Splunk Engineer you will be part of the Cyber Security division. The Cyber Security team is responsible for identifying and detecting threats, as well as protecting our customer and its clients from cyberattacks. As part of this young and diverse team, you will make a valuable contribution to the delivery of Managed Security Services and provide consulting services to our clients. A Splunk Engineer is responsible for designing, implementing, and maintaining Splunk infrastructure, ensuring the efficient collection, indexing, and analysis of machine data for security, IT operations, and business analytics. This role requires expertise in log management, data analysis, and troubleshooting while working closely with IT, security, and business teams to provide actionable insights.

Main responsibilities

• Splunk Deployment & Administration: Install, configure, and manage Splunk Enterprise, Splunk Cloud, and associated applications;
• Log Data Management: Ingest, index, and analyze logs from multiple data sources, including servers, network devices, applications, and cloud environments;
• Search and Dashboard Development: Create custom queries, dashboards, alerts, and reports using Splunk’s Search Processing Language (SPL);
• Performance Optimization: Optimize Splunk queries and configurations to enhance performance, reduce system load, and ensure efficient data retrieval;
• Troubleshooting & Incident Response: Diagnose and resolve Splunk-related issues, provide root cause analysis, and support incident response efforts;
• Capacity Planning & Upgrades: Monitor system health, plan for scaling, and manage software upgrades and patches;

Qualifications

• Strong knowledge of Splunk Enterprise, Splunk Cloud, and Splunk Enterprise Security (ES);
• Proficiency in SPL (Search Processing Language) and creating advanced searches, dashboards, and reports;
• Experience in log ingestion, parsing, and indexing from various data sources;
• Knowledge of Linux/Unix environments and basic scripting (Python, Bash, PowerShell);
• Familiarity with SIEM, SOAR, IT security, and compliance frameworks;
• Strong ability to analyze machine data, identify anomalies, and provide meaningful insights;
• Ability to work with cross-functional teams including security, IT operations, and business analysts;
• Splunk Certified Admin certification is a plus;
• Experience with cloud platforms such as AWS, Azure, or GCP;
• Fluent English;
• German (nice to have);