Senior Splunk Engineer

Position: Senior Splunk Engineer Location: Bensalem, PA Duration: 3.5 Months Scope: This role is responsible for engineering, deploying, configuring, and validating a multi-site, highly available Splunk Enterprise platform and extending it with Splunk Enterprise Security (ES). The engineer handles platform buildout, data onboarding, CIM alignment, ES enablement, tuning, and operational readiness. • Design and implement a multi-site, highly available Splunk Enterprise deployment including Cluster Manager, License Master, Deployer, Deployment Server, Monitoring Console, multi-site indexer cluster, and search head cluster. • Deploy and configure Universal Forwarders and Heavy Forwarders. Build deployment apps, server classes, and automated rollout scripts. • Onboard and validate data sources (e.g. Windows, Firewall, Cloud) and ensure proper CIM alignment. • Configure custom indexes, authentication (LDAP/SAML), SMTP relay, and load balancer requirements. • Install, configure, and operationalize Splunk Enterprise Security (ES). • Validate ES data model acceleration, correlation searches, dashboards, notable events, and use case logic. • Tune correlation searches, thresholds, data models, and platform performance. • Ensure ES content integration with the underlying Splunk Enterprise deployment. • Produce as-built documentation, architecture diagrams, runbooks, tuning guidance, and operational procedures. • Validate ingest pipelines, cluster stability, search performance, CIM compliance, and ES functionality. • Provide technical knowledge transfer and hands-on enablement to customer engineering teams. Required Skills & Experience • 5+ years of Splunk Enterprise engineering in distributed, clustered environments. • Direct experience deploying and tuning Splunk ES in production settings. • Strong ability to onboard diverse data sources and perform CIM alignment. • Linux administration and enterprise networking fundamentals. • Experience with authentication systems (LDAP, SAML). • Strong documentation and operationalization skills. Preferred Qualifications • Splunk Admin, Architect, or ES Specialist certifications. • Experience in large-scale or multi-site enterprise deployments. • Familiarity with security operations workflows and SIEM tuning.